Memory Corruption

Use-after-free in Node.js HTTP/2 implementation allows remote unauthenticated attackers to crash the Node.js process by sending crafted HTTP/2 RST_STREAM frames while the stream object remains in scope. The fix - 'defer rst stream while in scope' - confirms that RST_STREAM processing freed or invalidated memory still referenced by the active stream context. With CVSS A:H and AV:N/AC:L/PR:N/UI:N, this is a straightforward remote denial-of-service against any Node.js server with HTTP/2 enabled. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity network vector and multi-LTS-branch impact make patching urgent.

Out-of-bounds write in Schneider Electric IGSS (Interactive Graphical SCADA System) Definition module allows an attacker to corrupt memory - causing data loss or potential arbitrary code execution - when a victim imports a maliciously crafted CGF (configuration/definition) file. Exploitation is local and hinges on user interaction (opening/importing the file), with no authentication required once the operator is tricked. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Schneider Electric PSIRT) rates the flaw high at CVSS 8.4.

Out-of-bounds write in GNU binutils' BFD library (bfd/elf32-dlx.c) lets a crafted ELF/DLX object file corrupt memory and achieve arbitrary code execution when parsed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). Reported by Red Hat and tracked against RHEL 6-10, Hardened Images and OpenShift 4, the flaw is only reachable when binutils is compiled with the DLX backend (typically --enable-targets=all), so exposure is gated by a non-default build option. There is no public exploit identified at time of analysis (not in CISA KEV), though the researcher demonstrated code execution via a File Stream Oriented Programming (FSOP) attack on glibc FILE structures.

Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allow remote attackers to corrupt memory, with high confidentiality and availability impact and limited integrity impact. Exploitation is scoped to deployments that build and enable the affected experimental plugins rather than the default proxy core. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a use-after-free (CWE-416) in the intercept plugin, allowing a remote attacker to crash or destabilize the proxy server. The flaw carries a CVSS 4.0 base score of 8.2, driven entirely by high availability impact with no confidentiality or integrity effect, and exploitation depends on a specific attack condition (AT:P) rather than being trivially reproducible. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy or corrupt memory by triggering the plugin's cookie-manipulation and CIDR condition-matching logic. The flaw affects ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3, and is reachable over the network without authentication (PR:N) when a vulnerable header_rewrite ruleset is deployed. No public exploit identified at time of analysis; the primary consequence is denial of service (VA:H) with limited information exposure (VC:L).

Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows remote attackers to trigger out-of-bounds writes, use-after-free conditions, and path traversal, primarily resulting in denial of service and partial integrity impact against the caching proxy. The CVSS 4.0 score of 8.3 (High) reflects a network-reachable, no-privilege attack whose success depends on a specific attack requirement (AT:P), such as a Cripts-based configuration being in use. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free and time-of-check/time-of-use race, primarily crashing the proxy (high availability impact) with secondary low-level confidentiality and integrity exposure. It affects the 8.x, 9.x, and 10.x branches up to 8.1.9, 9.2.14, and 10.1.3, and is fixed in 9.2.15 and 10.1.4. Reported by Apache with a CVSS 4.0 score of 8.3; no public exploit identified at time of analysis and it is not on CISA KEV.

Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers corrupt memory by sending crafted headers to the proxy. It affects the 8.x, 9.x (through 9.2.14) and 10.x (through 10.1.3) branches, carries a high CVSS of 8.9 with a scope-change flag, and can lead to high integrity and availability impact. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the memory-corruption class makes it a strong patching priority.

Denial-of-service in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same (adjacent) network segment to send malformed PROFINET communication data that triggers an out-of-bounds write and a runtime exception, forcing a controlled stop of the affected PLC application. The impact is availability-only (no data disclosure or code execution is claimed by the vendor); the CVSS 4.0 vector confirms VC:N/VI:N/VA:H. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Denial of service in IBM WebSphere Liberty 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to cause service disruption via uncontrolled heap allocation, resulting in high availability impact. No public exploit or active exploitation reported; vendor patch is available.

Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerability requires user interaction and runs code in the context of the current user. No active exploitation or public exploit code is known at the time of analysis.

Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by enticing a user to open a malicious file. The out-of-bounds write vulnerability (CWE-787) requires no authentication and has not been reported as actively exploited or in the CISA Known Exploited Vulnerabilities catalog. No public exploit code is known at this time.

Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the current user's privileges. Adobe has released a security update to address this issue via bulletin APSB26-89. No active exploitation or public exploit has been identified at the time of analysis.

Remote code execution in pglogical extension for PostgreSQL allows a low-privileged user to crash replication workers, with potential for arbitrary code execution. A use-after-free condition in worker signaling code is triggered during normal replication operations when worker lifecycle events race. While typical effect is denial-of-service, a successful exploit can give complete control of the database backend process.

Memory corruption in Samsung's proprietary ImsService - the IP Multimedia Subsystem component handling VoLTE, Wi-Fi Calling and SIP signaling - can be triggered by a crafted message to produce an out-of-bounds write (CWE-787) and potentially execute arbitrary code on affected Samsung Galaxy devices. Devices running Android 14, 15 or 16 with firmware older than the SMR Jul-2026 Release 1 are exposed; exploitation requires reaching the IMS service stack (per the CVSS 4.0 vector it is unauthenticated with no user interaction, but AT:P indicates a non-attacker-controlled precondition such as an established or negotiable IMS session, a malicious IMS peer, or a position in the carrier signaling path), and confirmed impact is integrity and availability only, with no confidentiality loss. There is no evidence of active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), though the CISA SSVC assessment rates technical impact as total and patch availability (SMR Jul-2026 Release 1) limits the population of vulnerable devices over time.

Use-after-free vulnerability in Safari’s web content processing allows remote attackers to execute arbitrary code on affected Apple devices when a user visits a malicious website. Affected versions include Safari prior to 26.6, iOS and iPadOS prior to 26.6, macOS Tahoe prior to 26.6, visionOS prior to 26.6, and watchOS prior to 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.13%).

Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe/tvOS/visionOS/watchOS before 26.6 - where a use-after-free (CWE-416) lets a locally installed app crash the system. There is no public exploit identified at time of analysis and the NVD CVSS 9.8 (C:H/I:H/A:H) conflicts with Apple's own description, which states only 'unexpected system termination' (availability impact), suggesting the true impact is a DoS crash rather than full compromise. EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.

Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected system termination. Affected versions include iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. While the NVD assigns CVSS 9.8, the actual impact is limited to availability; no active exploitation or public exploit code is identified, and EPSS indicates very low exploitation probability (0.17%).

Unexpected system termination in iOS and iPadOS prior to 26.6, as well as in certain versions of macOS, tvOS, and visionOS, resulting from a use-after-free memory corruption. Apple's description indicates a local denial-of-service where a malicious app can crash the system, while the NVD-assigned CVSS 9.8 erroneously implies unauthenticated remote code execution. A patch is available, no active exploitation has been reported, and EPSS suggests a very low probability of wide exploitation.

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be triggered by a remote attacker via an out-of-bounds write. The issue, patched in the latest OS updates, carries a CVSS base score of 9.8 but is not known to be actively exploited. EPSS estimates a low 0.25% probability of exploitation, and no public exploit code has been identified.

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6 allows unauthenticated network attackers to corrupt heap memory via an out-of-bounds write. This can lead to arbitrary code execution or unexpected application termination, compromising the affected device

Type confusion in macOS and tvOS may allow a malicious app to trigger unexpected system termination and potentially achieve arbitrary code execution with kernel-level privileges. The issue is addressed in macOS Tahoe 26.6 and tvOS 26.6; no active exploitation or public proof-of-concept is known at the time of analysis.

Use-after-free memory corruption in Apple's core operating-system platforms - iOS/iPadOS, macOS Tahoe, tvOS, and watchOS before version 26.6 - allows a locally installed and executed application to crash or unexpectedly terminate the system. Exploitation requires the victim to run attacker-supplied code as an app on an unpatched device; there is no remote attack surface, and the demonstrable impact is availability only (system termination/reboot), with no data disclosure, modification, or code execution established - meaning the publicly circulated CVSS 9.8 network vector materially overstates the real reachability and impact of this bug. No public exploit identified at time of analysis, EPSS is low at 0.16% (6th percentile), CISA SSVC records Exploitation: none with total technical impact if reached, and Apple has shipped fixes in 26.6 across all four platforms.

An out-of-bounds write vulnerability in macOS allows a malicious application to cause unexpected system termination. Apple addressed this in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit is known, and EPSS indicates very low exploitation probability.

Use-after-free memory corruption in Apple's iOS 26.6-era platform family lets an already-installed app crash the operating system kernel or a system service, producing an unexpected system termination (denial of service). Affected software spans iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe before 26.6, and tvOS, visionOS and watchOS before 26.6; exploitation requires the attacker's app to run locally on the device, since the flaw is only reachable from within an executing process. The headline input score of CVSS 9.8 (AV:N) overstates the issue - Apple's own advisory describes impact limited to a crashing app, EPSS is a low 0.17% (6th percentile), CISA SSVC records no exploitation and no public exploit code exists, and no KEV listing or POC is associated with CVE-2026-43822.

A use-after-free vulnerability in Apple operating systems allows a malicious app to cause unexpected system termination or write to kernel memory. The issue affects iOS

Denial of service in Apple iOS, macOS, and related operating systems due to a use-after-free flaw could allow a malicious app to crash the device. Apple's advisory only confirms unexpected system termination, but an independent CVSS score of 9.8 suggests potential for full system compromise; however, the CVSS vector appears inconsistent with the vendor description. The vulnerability is patched in versions 26.6 for all affected OSes, and no active exploitation or public exploit code is known.

Denial-of-service vulnerability in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS due to an out-of-bounds write in a shared component. A malicious app executed locally can cause a system crash; the CVSS vector also suggests potential high confidentiality impact (memory disclosure), though the advisory only mentions denial-of-service. Fixed in updates; no active exploitation or public exploit code reported, and EPSS probability is very low (0.17%).

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an out-of-bounds write bug. An unauthenticated attacker can trigger heap corruption by sending a malicious payload over the network, leading to unexpected application termination or potential arbitrary code execution with no user interaction required. Apple has released platform patches fixing this critical vulnerability, and while no active exploitation or public exploit is known, the EPSS score indicates low near-term exploitation

Arbitrary code execution via malicious file processing affects multiple Apple operating systems due to an out-of-bounds write. Fixed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation or public exploit is known, and EPSS predicts a very low probability of real-world attacks.

A use-after-free memory-corruption flaw in Apple's mobile and desktop operating systems lets an app already running on the device trigger an unexpected system termination - a denial-of-service condition affecting availability only. The issue is fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6, meaning every device running an earlier build of those platforms is exposed. There is no evidence of active exploitation (not in CISA KEV, SSVC exploitation: none) and no public exploit code has been identified; EPSS is just 0.16% (6th percentile), and the widely circulated CVSS 9.8 AV:N/PR:N vector is grossly inflated relative to the assessed AV:L/AC:L/PR:N/UI:N impact of C:N/I:N/A:H.

A type confusion vulnerability in macOS allows an application to cause unexpected system termination (denial of service). Affected versions include macOS Sequoia, Sonoma, and Tahoe prior to the fixed releases; the issue has been patched by Apple. No public exploit is known, and EPSS indicates very low exploitation probability, with no active exploitation reported.

Unexpected system termination in macOS prior to Sequoia 15.7.8 and Tahoe 26.6 allows a local application to crash the operating system via an out-of-bounds write. Although the vulnerability is assigned a critical CVSS 9.8 due to potential memory corruption risks, the Apple advisory only confirms denial-of-service impact. No active exploitation is reported, and EPSS (0.15%) indicates low exploitation probability.

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected application termination or heap corruption via unspecified vectors. Given a CVSS score of 9.8, successful exploitation could lead to full system compromise. Patches are available from Apple in multiple OS updates, and no public exploit or active exploitation has been identified.

Out-of-bounds write in Apple operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) allows an attacker to trigger memory corruption leading to unexpected application termination when a victim processes maliciously crafted content. The flaw affects all major Apple platforms below the fixed versions and was reported and patched by Apple. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 7th percentile).

A use-after-free vulnerability in macOS allows a local application to cause a denial-of-service by crashing the system or a key service. The flaw affects multiple macOS versions prior to the Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 updates. Despite an assigned CVSS score of 9.8 suggesting remote pre-authentication full compromise, the Apple advisory explicitly describes only a local denial-of-service impact, and the EPSS exploitation probability is very low (0.16%). No active exploitation or public proof-of-concept has been reported, and a vendor patch is available.

Arbitrary code execution in Apple iOS and iPadOS, macOS, tvOS, visionOS, and watchOS permits an attacker to run code or terminate apps by luring a user into opening a crafted file. The out-of-bounds write issue was fixed in all supported Apple operating systems via June 2026 updates. No active exploitation or public proof-of-concept has been reported at time of analysis, and EPSS indicates a low probability of future exploitation.

Kernel memory corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to cause system termination or corrupt kernel memory. A use-after-free issue in the kernel’s memory management could be triggered by an app, leading to unexpected system behavior or potential code execution. Patches are available across all affected operating systems; no active exploitation has been observed.

Kernel privilege escalation in Zephyr RTOS v3.3.0-v4.4.1 is enabled by a signed/unsigned integer comparison error in the userspace syscall verifier for log_filter_set. An unprivileged user thread can supply a negative src_id value that bypasses the userspace bounds check, propagates into supervisor-mode kernel code, and - after implicit widening to uint32_t - indexes far out of bounds into kernel memory adjacent to the log_dynamic linker section, producing a constrained but attacker-directed read-modify-write primitive exploitable for privilege escalation. No public exploit has been identified at time of analysis; the fix, which replaces the flawed signed comparison with an unsigned one, is available in commit 56a15114.

Use-after-free in SQLite 3.41's JSON parser allows remote code execution. A remote attacker can deliver a crafted JSON payload; if a user or application processes it with SQLite, the vulnerability triggers memory corruption, potentially enabling full system compromise. A proof-of-concept advisory is publicly available, though no active exploitation has been confirmed.

Use-after-free in SQLite 3.41 expression parsing leads to memory corruption, allowing remote attackers to crash applications and leak sensitive memory contents via crafted SQL queries. Public proof-of-concept exists but there is no evidence of active exploitation. The vulnerability is triggered by sending malicious SQL statements that cause the parser to access a freed expression object.

Use-after-free in SQLite 3.41's expression-evaluation path lets an attacker who can submit a crafted SQL statement crash the process, leak adjacent memory, or potentially achieve code execution. The flaw stems from sqlite3ReleaseTempReg() prematurely freeing a temporary register that exprComputeOperands() then dereferences. Rated CVSS 7.5 (AV:N/AC:H/PR:L); publicly available exploit code exists per the CISA SSVC 'poc' determination, but it is not on the CISA KEV list and EPSS is low (0.24%, 16th percentile), indicating no evidence of widespread active exploitation.

Use-after-free in SQLite 3.41 allows remote attackers supplying crafted SQL to trigger memory corruption during parsing, leading to denial of service, sensitive information leakage, and potential arbitrary code execution.

Remote denial of service and heap memory leak in SQLite 3.41 via the json_remove() function allows attackers with the ability to execute SQL queries to crash the database process or leak sensitive heap data. A use-after-free in jsonRemoveFunc is triggered by malformed JSON and a deep path parameter; publicly available proof-of-concept code exists, and low EPSS risk indicates limited exploitation likelihood.

Memory corruption in SQLite 3.41's ORDER BY parsing allows remote attackers to crash the database process or leak sensitive data via crafted SQL queries. A use-after-free in ExprList handling, triggered by an ORDER BY clause with many items, can also lead to arbitrary code execution under specific memory conditions. A public advisory exists, but no active exploitation (KEV) or EPSS data is available.

Use-after-free in the Linux kernel's usbio (USB I/O bridge) driver allows a local, low-privileged attacker to corrupt kernel slab memory during USB device disconnect, potentially achieving privilege escalation or triggering a kernel panic. The bug lies in usbio_disconnect(), which iterates the client list in reverse using list_for_each_entry_reverse() - a macro that reads client->link.prev after the loop body, but auxiliary_device_uninit() can free the current client before that read, dereferencing freed slab memory. Patches are confirmed in Linux stable branches 6.18.39, 7.1.4, and 7.2-rc3; no public exploit or active exploitation is identified at time of analysis.

Use-after-free in the Linux kernel's 6LoWPAN NHC handler may allow network-adjacent attackers to execute arbitrary code or trigger denial of service by sending a malformed packet. Affects kernels with 6LoWPAN support from commit 92aa7c65d295 up to the patched versions. No active exploitation or public exploit code is known; EPSS probability is low at 0.22%.

Local privilege escalation in Linux kernel's vme_user staging driver via an out-of-bounds write in slave read/write helpers. A local attacker can overflow the fixed-size kern_buf when the VME window exceeds 128 KiB, leading to arbitrary code execution. No active exploitation or public exploit is known, but the vulnerability has been confirmed dynamically with KASAN; EPSS indicates low exploitation probability.

Heap buffer overflow in the Linux kernel's rtl8723bs staging WiFi driver (rtw_cfg80211_set_wpa_ie()) allows a local low-privileged user to corrupt kernel memory by one byte via a crafted nl80211 connect request, enabling potential privilege escalation to kernel context. The 256-byte supplicant_ie array in struct security_priv overflows when a WPA IE with length 255 is supplied, writing 257 bytes and clobbering the adjacent last_mic_err_time field; a flawed length check in rtw_parse_wpa_ie() using u8 narrowing silently permits the overflow. Patches are available across all active stable kernels; EPSS is 0.23% and no public exploit or CISA KEV listing exists at time of analysis.

Out-of-bounds write in the Linux kernel's rtl8723bs staging Wi-Fi driver when processing a maliciously crafted 802.11 Association Response frame. An attacker within Wi-Fi range can send an oversized HT Capabilities IE, leading to up to 229 bytes of kernel memory corruption, resulting in high integrity and availability impact with no user interaction or authentication required. No public exploit or active exploitation is known; EPSS indicates very low exploitation probability (0.22%).

Use-after-free in the Linux kernel's crypto/krb5 helper library (introduced in 6.15) occurs when Kerberos AEAD encrypt/decrypt operations are backed by an asynchronous AEAD implementation. The synchronous helpers in rfc3961_simplified.c and rfc8009_aes2.c set a NULL completion callback and treat any negative return as terminal, so an async backend returning -EINPROGRESS causes the buffer to be freed with kfree_sensitive() while the backend worker still dereferences it. This is reachable through kernel consumers of krb5 crypto (rxrpc/rxgk, AFS cm_security, and Ceph), but only on systems where an async AEAD provider is bound to the krb5 enctype name; no public exploit identified at time of analysis and EPSS is low at 0.21%.

Use-after-free in the Linux kernel's Intel QuickAssist Technology (QAT) SR-IOV driver allows a local low-privileged attacker - including a VM tenant with a VF assigned - to corrupt host kernel memory by racing VF2PF workqueue processing against SR-IOV teardown in adf_disable_sriov(). The VF2PF interrupt handler enqueues work that holds raw pointers to per-VF state (struct adf_accel_vf_info); adf_disable_sriov() freed that state without draining in-flight workers, enabling a concurrent worker to deref freed memory. No public exploit is known at time of analysis, and EPSS is 0.22% (13th percentile), indicating negligible observed exploitation pressure despite the 8.8 CVSS score.

Use-after-free in the Linux kernel's ksmbd (SMB server) allows authenticated remote attackers to trigger memory corruption, potentially leading to arbitrary code execution or denial of service. The flaw occurs when an SMB2_CLOSE on a locked file is followed by an SMB2_CANCEL, causing a freed file_lock to be re-accessed. A patch is available for affected kernel versions, and while no active exploitation is confirmed, a proof-of-concept exists; EPSS indicates low exploitation likelihood.

Use-after-free in the Linux kernel's Bluetooth L2CAP subsystem can be triggered by an adjacent attacker, potentially leading to arbitrary code execution or kernel memory corruption. The flaw occurs when a channel timeout callback races with connection teardown, allowing a freed connection object to be accessed. Patched kernels are available; no active exploitation is confirmed, but the vulnerability is remotely exploitable within Bluetooth range without authentication or user interaction.

Use-after-free in the Linux kernel Bluetooth MGMT subsystem allows a local attacker with low privileges to trigger kernel memory corruption via a race condition between add_device and remove_device operations. The flaw exists in add_device_complete(), which dereferences a hci_conn_params pointer without holding hci_dev_lock, while a concurrent MGMT_OP_REMOVE_DEVICE path frees the same object under that lock. KASAN confirms exploitation as slab-use-after-free; no public exploit or active exploitation (CISA KEV) has been identified, and patches have been released across multiple stable branches.

Heap-based out-of-bounds write in the Linux kernel's ntfs3 filesystem driver during journal replay allows local attackers to achieve kernel code execution by mounting a malicious NTFS image. The vulnerability exists because log_replay() does not validate Dirty Page Table capacity against attacker-controlled fields, leading to a slab corruption. No active exploitation or public exploit code has been identified, and the attack requires user interaction to mount a crafted filesystem.

Out-of-bounds memory write in the Linux kernel's legacy NTFS driver allows a local attacker with filesystem mount privileges to corrupt kernel heap memory via a crafted NTFS image. The flaw lives in `ntfs_icx_ib_sync_write()`, which unconditionally calls `post_write_mst_fixup()` even when `pre_write_mst_fixup()` has already rejected the index block as invalid - the caller does not distinguish between I/O errors and validation failures. By manipulating `usa_ofs` or `usa_count` fields in the NTFS index block, an attacker can drive both slab-out-of-bounds reads and writes into the kernel, as confirmed by KASAN traces in the bug report. No public exploit or CISA KEV listing exists; EPSS is 0.20%.

Use-after-free memory corruption in the Linux kernel's netpoll subsystem allows a local attacker or concurrent kernel path to access freed memory during the netpoll shutdown sequence. The flaw exists because cancel_delayed_work() - called from softirq context during __netpoll_cleanup() - does not block until the TX worker finishes, permitting queue_process() to dereference a kfree'd npinfo struct via container_of(). KASAN confirms the UAF; patches are available across multiple stable kernel branches, and no public exploit or KEV listing exists at time of analysis.

Use-after-free in the Linux kernel IPv4 IGMP subsystem allows a local low-privileged attacker to trigger kernel memory corruption or a system crash by racing network device destruction against concurrent multicast group lookups in softirq context. During ip_mc_destroy_dev(), multicast membership entries are scheduled for RCU reclamation via ip_ma_put() but are not unlinked from the per-device mc_hash table; concurrent softirq-path readers such as ip_check_mc_rcu() can then dereference a freed slab object, as confirmed by the embedded KASAN trace showing a read of freed memory during UDP packet processing. No public exploit code or CISA KEV listing exists at time of analysis; Ubuntu USN-8726/8727-1 and a Siemens ICS advisory confirm active patching across distributions.

Use-after-free memory corruption in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver is triggered during module removal (rmmod of imx8_isi), confirmed by KASAN slab-use-after-free reports. The root cause is an incorrect teardown order in mxc_isi_remove(): the crossbar cleanup frees media entity pads before the V4L2 cleanup has finished removing media links that reference those same pads, resulting in a dangling pointer dereference in __media_entity_remove_link(). No public exploit has been identified at time of analysis, and with EPSS at 0.21% (11th percentile), real-world weaponization appears unlikely despite the CVSS 7.8 score.

Use-after-free in the Linux kernel Bluetooth subsystem's bt_accept_dequeue() function allows an attacker with local or adjacent Bluetooth access to corrupt kernel heap memory or crash the system during L2CAP listening socket teardown. The bug stems from a reference-count sequencing error: the temporary queue-walk reference is dropped before bt_accept_unlink() removes the socket from the accept queue and drops its own reference, so if that was the final reference, the subsequent sock_hold() call dereferences freed slab memory. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS is 0.22% (13th percentile), consistent with low opportunistic exploitation risk.

Out-of-bounds write in the Linux kernel's CoreSight ultrasoc-smb driver when used as a perf AUX sink allows a local attacker to elevate privileges. The vulnerability arises from improper page index normalization in smb_sync_perf_buffer(), leading to a heap buffer overflow. Although no active exploitation or public proof-of-concept is known, the weakness has been patched upstream and carries an EPSS score of 0.21%.

Local privilege escalation in the Linux kernel's SMB client witness notification handler allows a low-privileged attacker to exploit a use-after-free condition. Affected are Linux kernel versions 5.11 and later that have the CIFS witness feature enabled. Successful exploitation can lead to arbitrary code execution with elevated privileges, fully compromising the system.

Use-after-free vulnerability in the Linux kernel's ksmbd SMB server allows remote attackers to execute arbitrary code. All kernel versions with ksmbd enabled from early commits up to the patched releases are affected, and the issue can be triggered by concurrent QUERY_DIRECTORY requests on the same file handle. A fix is available via multiple stable kernel branches, no active exploitation is reported in KEV, and EPSS indicates a low probability of widespread exploitation (0.21%).

Use-after-free in Linux kernel’s ksmbd SMB server occurs during deferred byte-range lock cancellation, allowing an authenticated attacker to potentially execute arbitrary code or crash the system. The vulnerability affects ksmbd versions prior to the released fixes (6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, 7.2-rc1). No active exploitation has been confirmed (no CISA KEV listing), and EPSS indicates a low probability of widespread exploitation.

Memory leak in the Linux kernel's SMB client encrypted receive path (receive_encrypted_standard()) allows a local low-privileged user or a cooperative malicious SMB server to exhaust kernel heap memory, with potential for heap grooming-based privilege escalation. The bug was introduced with commit b24df3e30cbf and affects multiple stable kernel series from 4.19 onward. No public exploit code exists and EPSS is 0.22%, but the kernel team's classification of CWE-787 and a C:H/I:H/A:H CVSS score reflect the Linux security team's assessment that the leaked kernel buffer is exploitable beyond simple resource exhaustion.

Local privilege escalation in the Linux kernel's pcc-cpufreq driver allows a low-privileged user to gain full root privileges. The vulnerability is a use-after-free and double-free flaw when evaluating ACPI _OSC negotiation, affecting all kernel versions from 2.6.34 until the fixed stable releases (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1). No active exploitation or public exploit has been identified, and EPSS indicates a low probability of widespread exploitation.

Local privilege escalation via stack buffer overflow in the Linux kernel's hid-goodix-spi driver allows a user with access to a Goodix SPI HID device node to corrupt kernel stack memory and achieve full system compromise. The goodix_hid_set_raw_report() function copies caller-supplied report data into a fixed 128-byte stack buffer without bounds checking, so a hidraw SET_REPORT ioctl carrying more than ~116 bytes overflows it. There is no public exploit identified at time of analysis, and the low EPSS score (0.23%) plus the local-only, hardware-specific attack surface indicate limited real-world exposure despite the high 7.8 CVSS.

Out-of-bounds write in the Linux kernel's HID wacom driver allows an adjacent attacker to corrupt kernel memory, potentially achieving code execution or crashing the system. The flaw, present in kernels from commit 5e013ad2... up to the fixed versions 6.18.39, 7.1.4, and 7.2-rc1, stems from a missing emptiness check that causes the FIFO to read stale data and bypass the buffer size guard. No active exploitation or public exploit code has been identified, and EPSS predicts a low exploitation probability (0.22%).

Use-After-Free in the Linux kernel HID letsketch driver allows local exploitation during device unbind, potentially enabling kernel memory corruption and privilege escalation on affected systems. The letsketch_probe() function arms a per-device kernel timer (inrange_timer) with a 100 ms timeout, but no .remove callback exists to drain the timer before devm cleanup frees letsketch_data and input_dev structures on USB unplug or rmmod, producing a UAF read/write into freed kernel memory. Patches are backported across six stable kernel branches; no public exploit code exists and EPSS is 0.21% (12th percentile), reflecting the niche device requirement and race-condition complexity.

Use-after-free in the Linux kernel HID appleir driver allows a local attacker to corrupt kernel memory during device removal, potentially achieving privilege escalation. The race condition exists between the key_up_timer callback (armed by appleir_raw_event() on each keydown/key-repeat) and hid_hw_stop(), which frees the underlying input_dev before the timer is drained. A second race window, where a USB URB completion during hid_hw_stop() can re-arm the timer via mod_timer(), means a simple teardown reorder is insufficient — the fix introduces a spinlock-gated 'removing' flag combined with timer_shutdown_sync() to permanently disable further callbacks. No public exploit has been identified at time of analysis, and EPSS is 0.22% (13th percentile).

Use-after-free in the Linux kernel HID lg-g15 driver allows a local attacker to trigger kernel memory corruption by racing device input events against USB keyboard removal. The driver allocates lg_g15_data via devm and schedules work items from HID report handlers (backlight cycle key on G15, G15 v2, G510), but lacked a remove callback to cancel pending work before devres freed the allocation. On kernel versions from approximately 5.5 through the unfixed stable branches, unplugging the keyboard while a work item is pending causes the worker to dereference freed memory via container_of, potentially enabling local privilege escalation. No public exploit has been identified and EPSS is 0.22% (13th percentile), indicating no observed widespread exploitation.

Incorrect RCU lock annotations in the Linux kernel's BPF LPM trie map implementation (`kernel/bpf/lpm_trie.c`) cause lockdep false positives on debug kernels when sleepable BPF programs access `BPF_MAP_TYPE_LPM_TRIE` maps via lookup, update, or delete operations. The mismatch arises because sleepable BPF programs hold `rcu_read_lock_trace()` while the trie code asserts `rcu_read_lock_bh_held()` or `rcu_read_lock_held()`, producing repeated 'suspicious RCU usage' kernel warnings per distinct callsite. The Linux kernel developers explicitly state no actual use-after-free occurs, since Tasks Trace RCU already serializes against trie node reclaim; however, the incorrect annotation undermines lockdep's ability to detect future regressions and is increasingly impactful as sleepable BPF LSM programs become common in production security tooling. No public exploit exists and no CISA KEV listing has been issued.

Use-after-free and memory leak in the Linux kernel's EHCI and FOTG210 USB isochronous submit paths expose systems running kernel versions from 2.6.15 through 7.1.3 to local kernel memory corruption by a low-privileged user. When an isochronous URB submission fails before the staged schedule handoff - either because the host controller becomes inaccessible or usb_hcd_link_urb_to_ep() returns an error - the ehci_iso_sched allocation is not freed and urb->hcpriv retains a dangling pointer, creating a UAF condition. No public exploit exists and the EPSS score is 0.21% (12th percentile), but vendor-released patches across multiple stable branches are available and should be applied to eliminate the risk.

Use-after-free in the Linux kernel USB gadget UDC subsystem exposes systems with DWC3-based USB controllers to a race condition between usb_del_gadget() and gadget_match_driver(), enabling a NULL pointer dereference that can crash the kernel or enable privilege escalation on unpatched systems. The flaw affects all major Linux stable branches from 5.15.x through 7.1.x prior to the patched releases, and is particularly relevant for embedded Linux, Android-based devices, and IoT hardware that use USB gadget/device mode. No public exploit has been identified at time of analysis, and EPSS remains at 0.21% (12th percentile), reflecting current low exploitation interest.

Use-after-free in the Linux kernel's idmouse USB fingerprint driver allows a low-privileged local attacker to corrupt kernel memory by racing a device disconnect against a file-descriptor release, potentially enabling local privilege escalation to root. The bug stems from `mutex_unlock()` accessing the freed driver-data structure after the lock is released, a documented non-atomic behavior; the fix introduces a `kref` reference counter to correctly manage object lifetime. Patches are available across all active stable branches; no active exploitation or public exploit has been reported.

Use-after-free in the Linux kernel's USB ldusb driver allows a local unprivileged user to corrupt kernel memory by racing disconnect() against release() on a connected USB device. The root cause is that mutex_unlock() is documented as non-atomic and may access the mutex object after it logically releases the lock, creating a window where the driver data structure can be freed while still in use. No public exploit has been identified at time of analysis, and EPSS is low (0.22%), but the C:H/I:H/A:H CVSS impact vector reflects the potential for full kernel privilege escalation if successfully triggered.

Use-after-free in the Linux kernel's USB iowarrior driver exposes systems with Code Mercantile IO-Warrior USB devices to kernel memory corruption, potentially enabling local privilege escalation to root. The defect exists because submitted write URBs are not cancelled during close(), leaving them in-flight at disconnect time; the completion handler then fires against already-freed device structures. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects minimal observed exploitation pressure, though the C:H/I:H/A:H CVSS impact reflects genuine kernel-level consequence.

Use-after-free in the Linux kernel USB iowarrior driver allows a local unprivileged user to corrupt kernel memory when a USB device disconnect races with a file release operation. The root cause is that mutex_unlock() is documented as non-atomic and may access the mutex structure after releasing the lock, meaning the driver data object can be freed while mutex_unlock() is still executing. An attacker who can trigger the race - by opening the iowarrior device and simultaneously provoking a USB disconnect - may achieve kernel memory corruption leading to privilege escalation. No public exploit code exists and EPSS is low (0.21%), but the impact class is standard kernel UAF.

The Linux kernel's legousbtower USB driver contains a use-after-free race condition between the release() and disconnect() code paths, present since Linux 2.6.25. An authenticated local user with a LEGO USB Tower device attached can trigger the race at disconnect time to corrupt freed kernel memory, potentially gaining elevated privileges or crashing the system. Patches have been issued across all active stable branches (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1); no public exploit code or CISA KEV listing exists at time of analysis.

Local privilege escalation in the Linux kernel's digi_acceleport USB serial driver allows authenticated local users to corrupt kernel memory and execute arbitrary code as root. The vulnerability arises from a race condition in the digi_write_inb_command() function that mishandles timeouts and incorrectly updates transfer buffers, leading to write buffer corruption. No active exploitation has been reported, and publicly available exploit code has not been identified; a vendor patch is available across multiple stable kernel branches.

Use-after-free in the Linux kernel's USB Type-C UCSI CCG driver allows a local attacker with low privileges to corrupt kernel memory, potentially achieving arbitrary kernel code execution. The flaw exists in the module teardown path of the Cypress CCG UCSI driver: ucsi_ccg_remove() calls ucsi_destroy() - which kfree()s the ucsi object - before calling free_irq(), leaving a window in which the threaded IRQ handler ccg_irq_handler() can access the freed ucsi struct via ucsi_notify_common(). No public exploit code exists and the bug was discovered by static analysis; EPSS is 0.22% (13th percentile), reflecting no observed in-the-wild activity.

Out-of-bounds read in the Linux kernel's UDF filesystem driver allows a local low-privileged attacker to leak kernel memory or cause a denial of service by mounting a crafted UDF image with a malicious Virtual Allocation Table (VAT) header. The vulnerability resides in the udf_load_vat() function, which fails to validate the attacker-controlled VAT header length against the inode size, leading to a large out-of-bounds read index. No active exploitation or public proof-of-concept has been identified; EPSS predicts a very low exploitation probability (0.22%).

Out-of-bounds read and write in the Linux kernel's UDF filesystem driver allows a local attacker with the ability to mount a crafted UDF image to escalate privileges to root. The vulnerability stems from the sparing table length being validated as a byte count but consumed as an entry count, leading to memory corruption. No active exploitation (KEV) or public proof-of-concept is currently known, and EPSS estimates a 0.22% chance of exploitation in the next 30 days.

Use-after-free and missing forward security in the loongson-rng crypto driver of the Linux kernel allow a local, low-privilege attacker to corrupt memory and potentially execute arbitrary code, compromise system integrity, or read sensitive information. Affected systems are primarily Loongson-based machines running kernels between v6.18 and the respective fix versions; the driver itself is unused by any in‑kernel consumer and is being removed entirely rather than patched. No active exploitation or public exploit code is known, and the EPSS exploitation probability is low (0.21%).

Use-after-free and list corruption in the Linux kernel's Intel QuickAssist Technology (QAT) crypto driver allows a local low-privileged attacker to trigger kernel memory corruption by racing concurrent service registration and device lifecycle operations. The crypto/qat subsystem's service_table linked list is guarded by service_lock only during insertions and deletions, but seven device-state functions iterate the list unprotected, enabling a concurrent adf_service_register() or adf_service_unregister() call to mutate the list mid-traversal. Exploiting this race can result in kernel crash, arbitrary kernel memory read, or local privilege escalation to root. No public exploit code has been identified and EPSS stands at 0.21% (11th percentile), but the impact class is high for systems running QAT-capable Intel hardware.

Out-of-bounds write in the Linux kernel Intel QAT (Quick Assist Technology) RSA CRT driver corrupts kernel DMA memory when a local attacker supplies an RSA private key with CRT components larger than half the modulus size. The QAT driver's qat_rsa_setkey_crt() allocates DMA buffers at key_sz/2 but the right-alignment expression `dst + half_key_sz - len` wraps on unsigned underflow when len > half_key_sz, directing memcpy to write attacker-controlled bytes past the DMA allocation. No public exploit code exists at time of analysis; EPSS is 0.22% and the bug has been present since Linux 4.8 across all maintained stable branches.

Use-after-free vulnerability in the Linux kernel's fsl-lpspi SPI driver can lead to memory corruption or arbitrary code execution with kernel privileges. A local attacker with high privileges on systems using the affected driver can trigger this flaw, potentially causing a kernel panic or full system compromise. At time of analysis, no public exploit or active exploitation is identified, and EPSS indicates low exploitation probability (0.22%).

Page use-after-free in the Linux kernel perf/aux subsystem allows a local authenticated attacker to read or write freed kernel memory, potentially achieving privilege escalation. The flaw arises because map_range() accesses rb->aux_pages[], rb->aux_nr_pages, and rb->aux_pgoff while holding only the per-event mmap_mutex, whereas those fields are serialised by the ring-buffer-level rb->aux_mutex; two events sharing one ring buffer via PERF_EVENT_IOC_SET_OUTPUT can therefore race rb_alloc_aux() against map_range(), leaving a VM_PFNMAP mapping pointing to a freed physical frame. No public exploit has been identified at time of analysis, and EPSS exploitation probability is very low at 0.21% (11th percentile).