Memory Corruption

Out-of-bounds read and write in the Linux kernel synaptics-rmi4 input driver allows a local attacker with low privileges to gain full root access by exploiting a bound-check flaw in the F30 GPIO/LED interrupt handler. Affects kernels where gpioled_count exceeds 6 and GPIO support is enabled, leading to memory corruption through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls. No known active exploitation, no public exploit code, and EPSS risk is very low (0.22%).

Stack out-of-bounds write in the Linux kernel Goodix touchscreen driver allows kernel stack memory corruption through a malicious, counterfeit, or physically tampered Goodix I2C touchscreen controller that advertises more than the supported maximum of 10 contact points. All Linux kernel versions from 4.1 through the pre-patch stable series are affected on systems equipped with Goodix GT-series touchscreen hardware; patched releases are available across all active stable branches. No public exploit code exists and no active exploitation has been reported (absent from CISA KEV), with EPSS placing exploitation probability at 0.22%.

Stack out-of-bounds write in the Linux kernel's mms114 touchscreen driver allows a physically-positioned attacker with access to the I2C bus - or the ability to substitute a malicious or counterfeit controller - to overwrite the IRQ-thread stack, corrupting the stack canary, saved registers, and return address for potential kernel-level code execution. Affected systems include Linux kernel builds from version 3.6 onward that load the mms114 driver on hardware incorporating the Melfas MMS114 touchscreen controller. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at just 0.21%, consistent with the narrow hardware-specific attack surface.

Out-of-bounds write in the Linux kernel's siw RDMA driver allows a remote attacker on an established iWARP connection to cause memory corruption and potential code execution by sending a crafted sequence of Read Response segments that exceed the read request's buffer length. Affects all Linux kernel versions with the siw driver since 5.3. No public exploit is known, and EPSS score is low (0.22%), but the CVSS rating is Critical (9.8).

A use-after-free in the FUSE subsystem of the Linux kernel allows a local attacker with permission to mount a FUSE filesystem to escalate privileges or crash the system. The vulnerability exists in fuse_ref_folio() due to improper request locking, and affects kernel versions from 2.6.35 through unpatched longterm branches. Patches are available, and no active exploitation or public exploit code has been identified.

Local privilege escalation in the Linux kernel FUSE subsystem allows a low-privileged attacker to corrupt kernel memory

Local privilege escalation in the Linux kernel's fuse-uring subsystem allows a local attacker to trigger a use-after-free condition by racing with the async stop queues function, potentially resulting in arbitrary code execution and complete system compromise. The vulnerability affects Linux kernel versions 6.14 through 6.18.x (patched in 6.18.39, 7.1.4,

Use-after-free in the Linux kernel’s fuse-uring subsystem allows a local authenticated attacker to escalate privileges. The race condition occurs when a malicious userspace sends a commit SQE before the kernel completes the memcpy of request data, triggering a freed fuse_req to be reused. CVSS base score is 7.8 but EPSS probability is low (0.21%), and no public exploit or active exploitation has been reported.

...

Use-after-free in the Linux kernel's power sequence (pwrseq) debugfs seq_file handler allows a local attacker with low privileges to achieve privilege escalation or system compromise. The flaw arises from incorrect device reference counting in the seq_next callback, leading to reuse of a freed pointer. Affected kernels include versions since commit 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c; no active exploitation or public exploit has been confirmed at the time of analysis.

Use-after-free in the Linux kernel FPGA region subsystem allows a local authenticated attacker with low privileges to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability impact. The flaw in `child_regions_with_firmware()` stems from `of_node_put(child_region)` freeing the node before `pr_err()` dereferences the same pointer on an error path - a deterministic UAF triggered by a specific error condition in FPGA device tree enumeration. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), placing this firmly as a maintenance-priority fix for most environments rather than an emergency response item.

Use-after-free in the Linux kernel's linkstation-poweroff driver exposes systems running affected kernel versions on Buffalo LinkStation NAS hardware to local privilege escalation. The flaw resides in linkstation_poweroff_init(), where of_node_put(dn) was called before of_match_node() finished using the pointer, producing a kernel-space use-after-free that can corrupt slab-allocated memory. No public exploit has been identified and the EPSS score of 0.16% (6th percentile) indicates very low observed exploitation probability, though the official CVSS base severity is 7.8 (High) with confirmed high impact to confidentiality, integrity, and availability.

Use-after-free in the Linux kernel fbdev subsystem's fb_find_mode() function allows a local attacker with low privileges to read freed kernel heap memory, potentially achieving information disclosure, memory corruption, or privilege escalation. The flaw exists when mode_option is NULL: a heap-allocated buffer (mode_option_buf) is freed while the local alias name still references it during the name_matches() comparison loop. Patched versions are available across multiple stable branches (6.6.144, 6.12.95, 6.18.38, 7.1.3, 7.2-rc1). No public exploit exists and EPSS sits at the 6th percentile, but the CVSS 7.8 High score correctly reflects the maximum-impact potential of kernel-level heap memory corruption.

Use-after-free in the Linux kernel DAMON (Data Access Monitor) sysfs subsystem allows a local, low-privileged user with sysfs write access to corrupt kernel memory structures, potentially escalating to full kernel-level code execution. The DAMOS tried-region directory removal function (damon_sysfs_scheme_regions_rm_dirs()) decrements kobject reference counts but omits removing region objects from the tracking linked list; asynchronous execution of the kobj release callback leaves dangling list entries that a concurrent list rebuild can write into freed memory. No public exploit or active exploitation has been identified - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - consistent with a hardening fix rather than an actively weaponized flaw.

Local privilege escalation in the Linux kernel's sched_ext subsystem allows a low-privileged local attacker to achieve root access via a use-after-free error in the scx_root_enable_workfn() initialization failure path. The vulnerability is fixed by reordering the put_task_struct() call after scx_error() to prevent premature freeing of the task structure. No active exploitation or public exploit has been reported, and EPSS indicates low exploitation likelihood.

Local privilege escalation in the Linux kernel's ti-qspi SPI driver results from a use-after-free when DMA setup fails, allowing a local attacker to potentially execute arbitrary code or crash the system. The vulnerability affects Linux kernels from version 4.12 up to the patched stable releases 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No active exploitation has been confirmed (CISA KEV not listed), and the EPSS probability is low (0.18%), indicating limited real-world likelihood.

Out-of-bounds write in the Linux kernel's netfs subsystem enables a local, low-privileged attacker to corrupt kernel memory by crafting network filesystem I/O operations that cause iov_iter_extract_pages() to overfill the pages[] array in netfs_extract_user_iter(). The memory corruption occurs before any bounds guard is applied, making this a CWE-787 write-past-end condition with kernel privilege escalation potential. No public exploit code exists and the CVE is absent from the CISA KEV catalog; EPSS is 0.17% (6th percentile), consistent with no observed active exploitation.

Use-after-free in the Linux kernel’s netfs library allows a local attacker to escalate privileges or cause denial of service. The race condition occurs when unlocking abandoned read folios after a netfs request completes, potentially corrupting kernel memory. No active exploitation or public exploit is known at this time.

Memory corruption in Apache NimBLE BASS service allows a nearby, paired attacker to exploit an integer underflow during parsing of Add Source or Modify Source PDUs, leading to a stack buffer overflow or arbitrary out-of-bounds read. This can result in full device compromise. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability, but a vendor patch is available.

Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafted commands that trigger out-of-bounds memory writes beyond the guest's virtualized GPU boundaries. Affected versions include 26.1 RTM1, 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, and 25.1 RTM2 through 25.3 RTM. No active exploitation or public exploit has been observed; EPSS probability is 0.14% (very low) and CISA SSVC indicates neither exploitation nor automatable attack patterns, suggesting low real-world risk despite a high CVSS score of 7.8.

Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands via its kernel-mode driver, triggering memory corruption that escapes virtualization boundaries. Affected versions include 24.2, 25.1 through 25.3, 1.18, and 23.2 RTM2 releases. No public exploit code or active exploitation has been identified; EPSS probability is very low at 0.14%.

Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privileges. The vulnerability stems from improper reference counting on synchronization primitives during fence export, enabling a low-privileged user to achieve kernel read/write and full system compromise. No active exploitation or public exploit is confirmed, and EPSS indicates low exploitation probability.

Use-after-free in Chrome's Input component enables an attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. Affected versions span all Google Chrome releases prior to 150.0.7871.186 across Windows, macOS, and Linux. Successful exploitation grants code execution outside the sandbox with the full privileges of the browser process on the underlying host. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS stands at 0.25% (16th percentile), consistent with no observed in-the-wild activity.

Remote code execution in the Blink rendering engine of Google Chrome versions prior to 150.0.7871.186 allows an attacker to run arbitrary code inside Chrome's sandbox when a victim visits a crafted HTML page. The vulnerability has a high CVSS score (8.8) but a low EPSS exploitation probability (0.30%), and no active exploitation has been observed (CISA KEV not listed). A vendor patch is available.

Remote code execution inside a sandbox in Google Chrome prior to 150.0.7871.186 allows attackers to execute arbitrary code via a crafted HTML page. This use-after-free vulnerability requires user interaction and has a high CVSS score but low real-world exploitation probability (EPSS 0.30%). No active exploitation or public exploit code has been identified.

Out-of-bounds write in Google Chrome's Codecs component allows remote unauthenticated attackers to potentially escape the browser sandbox and compromise the system via a crafted HTML page. The vulnerability affects Chrome versions before 150.0.7871.186. No active exploitation or public exploit is known, but prompt patching is essential given the high impact.

Heap out-of-bounds write in FFmpeg's vf_swaprect video filter (versions 3.0 through 8.1.2) lets an attacker corrupt heap memory by getting the library to process a crafted NV12 video frame with odd width, causing an 18-byte copy into a 17-byte buffer. Successful exploitation causes at minimum a process crash and potentially arbitrary code execution in the context of the application embedding FFmpeg. Reported by VulnCheck with an upstream fix committed; there is no public exploit identified at time of analysis and it is not on CISA KEV.

Out-of-bounds heap write in FFmpeg's vf_floodfill video filter (versions 3.4 through 8.1.2) lets an attacker corrupt heap memory by feeding a specially crafted, dynamically sized video stream to a filtergraph where reinitialization is disabled via -reinit_filter 0. Reported by VulnCheck with a vendor patch available and no public exploit identified at time of analysis, the flaw reliably crashes the process and carries potential for code execution depending on heap layout and process hardening. Exploitation is local and requires the victim to process attacker-supplied media through the specific floodfill configuration.

Out-of-bounds heap write in FFmpeg through 8.1.2 lets an attacker who supplies a crafted ffconcat file - processed with the -safe 0 flag - corrupt heap memory and potentially achieve code execution. The flaw chains the TY demuxer's demux_audio() (which decrements packet size without bounds checking) into the Shorten decoder's memcpy(), where a negative size wraps to near SIZE_MAX. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.

Heap out-of-bounds write in FFmpeg's TDSC video decoder (versions 2.7 through 8.1.2) lets a remote attacker corrupt heap memory and potentially achieve code execution when a victim opens or transcodes a crafted AVI file whose frame dimensions change across TDSF frames. The flaw carries a CVSS 4.0 base score of 8.5 with high confidentiality, integrity, and availability impact, and requires the target to process the malicious file (UI:P). No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was reported by VulnCheck.

Denial of service in MongoDB's mongod server allows any authenticated user holding only read privileges to crash the database by submitting aggregation pipeline expressions that invoke server-side JavaScript, triggering a use-after-free (CWE-416) during document processing. The flaw affects availability only and requires valid low-privilege credentials; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Information disclosure in MongoDB's server-side JavaScript engine allows authenticated database users to read fragments of internal server process memory. The flaw stems from improper handling of DBPointer objects during BSON serialization, causing uninitialized or adjacent memory contents to be returned to the client. Only deployments that enable server-side JavaScript are affected; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Out-of-bounds read and write in the FFmpeg ADX audio decoder (libavcodec/adxdec.c) affects versions 4.4 through 8.1.2, where a mid-stream channel layout change corrupts memory. When AV_PKT_DATA_NEW_EXTRADATA side data arrives mid-stream, adx_decode_frame re-parses the header but leaves the internal channel state stale, so later decode operations index the prev[] state array with a wrong channel count. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw enables both reads and writes and carries a CVSS 4.0 base score of 8.7.

Heap buffer overflow (out-of-bounds write) in FFmpeg's VobSub subtitle demuxer lets an attacker corrupt adjacent heap memory and potentially achieve arbitrary code execution in any application that links FFmpeg's libavformat and processes a malicious .sub/.idx file. All releases from 2.1 through 8.1.2 are affected. A vendor patch exists (commit dbd495f) and the issue was reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Sandbox escape in Google Chrome for Android prior to 150.0.7871.182 stems from a use-after-free in the GPU component, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Chromium rates the severity High; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. As a second-stage primitive it is typically chained with a separate renderer bug to achieve full device compromise on Android.

Use-after-free in the Google Chrome UI component (fixed in 150.0.7871.182) allows a remote attacker to induce heap corruption when a victim visits a crafted HTML page and performs specific UI gestures, potentially leading to arbitrary code execution in the renderer. Rated High by Chromium and CVSS 8.8; no public exploit identified at time of analysis, though the vendor patch is available. Exploitation is gated on user interaction, reducing drive-by risk relative to zero-click browser bugs.

Arbitrary code execution within the sandbox in Google Chrome prior to 150.0.7871.182 via a type confusion flaw in the WebAudio API. A remote attacker can craft an HTML page that, when opened by a victim, triggers memory corruption leading to code execution in the renderer process. No public exploit or active exploitation has been identified, and EPSS indicates a low exploitation probability despite a high CVSS score.

Sandbox escape in Google Chrome prior to 150.0.7871.182 via an out-of-bounds write in the ANGLE graphics layer allows remote attackers to escape the browser sandbox after compromising the renderer process. No active exploitation or public exploit has been confirmed; EPSS likelihood is very low.

Arbitrary code execution in libheif 1.19.0 through 1.21.2 via a crafted HEIF file with uncompressed, tiled, component-interleaved, 4:2:0 encoding allows an attacker to overwrite a C++ vtable pointer and redirect control flow. Exploitation requires user interaction to open the malicious file, and no public exploit code is known, though EPSS indicates a low probability of widespread exploitation.

Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can write the shared backing file corrupt process memory or crash consumers of the disjoint-set structure. The dsu_find routine trusts a file-stored parent index that is never bounds-checked against the node count, so the next find or union operation dereferences and path-compresses through an out-of-bounds pointer. No public exploit is identified at time of analysis, and the EPSS score is very low (0.17%), consistent with a niche CPAN module rather than a broadly exploited target.

Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write access to the shared backing file corrupt memory in any process that queries or inserts into the spatial hash. The attach-time validator sph_validate_header checks header scalars and region layout against file size but never validates the array contents it subsequently trusts, so poisoned bucket, next-link, and free-list indices flow unchecked into sph_walk_cell and sph_alloc_slot. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and the module is not in CISA KEV.

Denial of service (and potential use-after-free) in libssh occurs when the library processes SSH data packets that arrive after a channel has been closed, causing channel data callbacks to fire against already-freed memory. Any application or system linking the affected libssh - including Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images - can be crashed by a malicious SSH peer that sends channel data at the wrong point in the connection lifecycle. There is no public exploit identified at time of analysis, EPSS is low (0.26%), and CISA SSVC scores exploitation as none, indicating a real but non-urgent memory-safety fix.

Memory-corrupting type confusion in Firefox's JavaScript JIT engine allows a remote attacker to serve a malicious web page that triggers a JIT miscompilation, corrupting memory to disclose sensitive data or achieve code execution in the content process; Mozilla fixed it in Firefox 153. No public exploit is identified at time of analysis, and the EPSS score is low (0.13%, 3rd percentile), indicating no observed weaponization yet despite the critical 9.8 CVSS rating.

Denial of service in Mozilla Firefox before version 153 arises from an invalid pointer access (CWE-824) in the PSM (Personal Security Manager) security component, which brokers TLS/certificate and NSS cryptographic operations. Remote content processed by the browser can trigger the invalid pointer dereference, crashing the affected process; the assigned CVSS 3.1 vector scopes impact to availability only (A:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.13% (3rd percentile), consistent with a stability/crash bug rather than a code-execution primitive.

Sandbox escape via use-after-free in Mozilla Firefox's Disability Access (accessibility) APIs allows an attacker who has compromised the content process to break out of the browser sandbox and gain code execution at the host privilege level. It affects Firefox before 153 and the ESR 115.x and 140.x branches, was reported and patched by Mozilla, and carries no public exploit at time of analysis. EPSS is low (0.15%, 5th percentile) and it is not on CISA KEV, indicating no observed exploitation.

Memory corruption in Mozilla Firefox's JavaScript engine JIT compiler allows attackers to corrupt memory and potentially achieve arbitrary code execution when a victim visits a malicious web page. The flaw stems from a JIT miscompilation (type confusion, CWE-843) affecting Firefox before 153, ESR before 115.38, and ESR before 140.13, and carries CVSS 9.8. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).

Memory corruption in Mozilla Firefox's DOM Bindings (WebIDL) layer allows a remote attacker who serves malicious web content to trigger a use-after-free (CWE-416) via an invalid/dangling pointer, potentially leading to arbitrary code execution or information disclosure in the content process. All Firefox and Firefox ESR builds prior to the fixed releases are affected. There is no public exploit identified at time of analysis, and the low EPSS score (0.15%, 5th percentile) suggests exploitation is not yet observed in the wild, though Mozilla rates the memory-safety impact as high.

Sandbox escape in Mozilla Firefox stems from a use-after-free in the Disability Access (accessibility) APIs, letting an attacker who already controls a sandboxed content process break out of the browser sandbox and compromise the host. It affects Firefox before 153 and the ESR 115.x and 140.x branches, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the EPSS score is low (0.15%, 5th percentile), indicating no observed widespread exploitation.

Sandbox escape in Mozilla Firefox stems from a use-after-free (CWE-416) in the DOM: Navigation component, letting web-reachable content corrupt memory and cross the content-process sandbox boundary. Affected builds are Firefox before 153, Firefox ESR before 115.38, and Firefox ESR before 140.13; Mozilla self-reported the issue and shipped fixes across all three branches (MFSA-2026-68/69/70). There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), indicating no observed weaponization yet despite the 9.8 CVSS rating.

Use-after-free in the WebRTC Audio/Video component of Mozilla Firefox allows a remote attacker to corrupt memory and potentially achieve arbitrary code execution when a victim visits a malicious page or joins a crafted WebRTC session. All Firefox builds prior to 153 and ESR builds prior to 140.13 are affected, with high impact to confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the EPSS probability is low (0.15%), but browser memory-corruption bugs of this class are historically attractive exploitation targets.

Memory disclosure and denial-of-service in Apache Fory's Rust deserialization path (versions 0.13.0 through 1.3.0) let remote attackers submit a crafted Fory-serialized payload that triggers a use-after-free, causing undefined behavior, process crashes, or leakage of adjacent process memory. The flaw affects any service that deserializes untrusted Fory data using the Rust implementation, and Apache has published a fixed release (1.4.0). There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile), but the network-reachable, unauthenticated attack surface makes it a meaningful hardening priority for exposed services.

Use-after-free in the Linux kernel's Qualcomm rmnet networking driver allows a local attacker with low privileges to escalate to kernel-level code execution. The flaw occurs when the rmnet endpoint is freed while still being referenced by concurrent receive path handlers, leading to memory corruption. No active exploitation or public exploit code has been identified, but the high CVSS score reflects a significant local privilege escalation risk.

Remote code execution and information disclosure in Google Chrome desktop before 150.0.7871.128 stems from a use-after-free flaw (CWE-416) that a malicious web page can trigger when a victim simply visits it. The CVSS 3.1 score of 9.6 with a scope change reflects a likely sandbox-boundary crossing, giving an attacker high impact on confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the EPSS probability is low (0.22%, 12th percentile), but browser use-after-free bugs are a historically favored exploitation target.

Use-after-free in Google Chrome desktop versions prior to 150.0.7871.128 allows a remote attacker to corrupt memory and potentially achieve renderer code execution after a victim visits a crafted web page. The flaw carries a critical CVSS 9.6 owing to its network vector, low complexity, and scope-changing impact, though it requires user interaction (loading a malicious page). No public exploit has been identified at time of analysis and the EPSS probability is low (0.23%, 14th percentile).

Use-after-free memory corruption in Google Chrome for desktop before version 150.0.7871.128 lets a remote attacker corrupt heap memory and potentially achieve code execution or information disclosure after a victim visits an attacker-controlled page. The flaw carries a CVSS 9.6 with a scope change reflecting the browser sandbox boundary, but currently shows no public exploit and a low EPSS probability (0.22%, 12th percentile). It is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.

Use-after-free memory corruption in Google Chrome for desktop before version 150.0.7871.128 lets a remote attacker corrupt heap memory and potentially execute arbitrary code or disclose sensitive information after the victim interacts with attacker-controlled web content. The flaw was fixed in the Stable channel update and reported downstream by the Ubuntu security team; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 7.8 CVSS reflects full confidentiality, integrity, and availability impact once a user is lured to malicious content.

Use-after-free memory corruption in Google Chrome versions prior to 150.0.7871.128 allows a remote attacker to corrupt heap memory and potentially disclose sensitive information or execute code after a user visits a malicious web page. The flaw was reported through the Ubuntu vendor channel and fixed in Chrome's Stable desktop channel; no public exploit identified at time of analysis, and its EPSS exploitation probability is low (0.22%). Successful exploitation requires user interaction (visiting attacker-controlled content) but no authentication.

Use-after-free memory corruption in Google Chrome prior to 150.0.7871.128 allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution when a victim visits a malicious web page. The flaw carries a CVSS 9.6 with a scope change, reflecting the risk of escaping the renderer sandbox, though exploitation requires user interaction. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.27%, 19th percentile), consistent with a freshly patched browser bug that has not yet been weaponized.

Use-after-free read in the Linux kernel Bluetooth BNEP subsystem allows a local privileged user (CAP_NET_ADMIN) to read freed net_device memory by winning a race against concurrent teardown. Affected kernels span from 2.6.12 through the 6.x/7.x stable series until the fixed releases (e.g. 6.12.92, 6.6.142, 6.1.175, 5.15.209, 5.10.258, 6.18.34, 7.0.11, 7.1). The upstream maintainers explicitly characterize this as low practical security interest; there is no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile).

Memory leak in the Linux kernel's wilc1000 WiFi driver exposes systems with Microchip WILC1000 adapters to kernel heap exhaustion. The function wilc_wlan_firmware_download() allocates a DMA buffer via kmalloc() but an early-return path after the first acquire_bus() call bypasses the established cleanup label, leaking the buffer unconditionally on bus acquire failures. No public exploit has been identified and EPSS probability is extremely low (0.17%, 6th percentile), but repeated triggering on affected embedded hardware could degrade system stability. Upstream stable fixes are available as confirmed kernel commits targeting 6.18.x, 7.0.x, and 7.1.

Use-after-free in the Linux kernel's ksmbd (in-kernel SMB3 server) durable-handle scavenger allows a remote client interacting with SMB2 durable handles to corrupt kernel memory and free a file object still referenced by concurrent m_fp_list walkers. The flaw stems from two related races in ksmbd_durable_scavenger() - a list_head reuse that corrupts f_ci->m_fp_list and a refcount/unlink race that leaves a freed handle reachable by rename and share-mode lookups. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not in CISA KEV, so exploitation is unproven despite the NVD 9.8 rating.

Use-after-free in the Linux kernel's IPv6 In-situ OAM (IOAM) hop-by-hop option handler (ipv6_hop_ioam) lets a crafted IPv6 packet trigger access to a freed skb data buffer on hosts configured as IOAM nodes. After skb_ensure_writable() reallocates the socket buffer via pskb_expand_head(), the code refreshes the trace pointer but leaves the stale hdr pointer, so hdr->opt_len is later read from freed memory when calling ioam6_event(), enabling potential information disclosure or kernel crash. This is a resolved upstream fix with no public exploit identified at time of analysis and a low EPSS score (0.18%, 7th percentile).

Slab use-after-free in the Linux kernel's HSR (High-availability Seamless Redundancy) networking subsystem lets a local attacker read freed heap memory. Generic-netlink node-list/node-status operations walk hsr->node_db under rcu_read_lock(), but RTM_DELLINK teardown (hsr_dellink -> hsr_del_nodes) removed nodes with a plain list_del() and freed each hsr_node immediately, so a concurrent reader could dereference a freed node and copy node->macaddress_A. No public exploit is identified at time of analysis and EPSS is low (0.17%, 7th percentile); the flaw is a race-window read primarily affecting confidentiality and stability rather than a remote RCE.

Kernel-memory use-after-free in the Linux mlx5e Ethernet driver (NVIDIA/Mellanox ConnectX mlx5_core) occurs when mlx5e_tx_reporter_timeout_recover() dereferences sq->netdev after mlx5e_safe_reopen_channels() has already freed the channel and its embedded send queues during TX-timeout health recovery. Systems using mlx5 NICs are affected; the freed-pointer read can corrupt kernel state, leak kernel memory, or crash the host. No public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV, so this is a reliability/hardening fix rather than an actively exploited threat despite the NVD 9.8 score.

Memory corruption (slab use-after-free) in the Linux kernel's mac80211 wireless stack allows an adjacent attacker on an 802.11s mesh network to trigger a KASAN-detected use-after-free in the fast-RX receive path. When a unicast frame is forwarded by mesh_data and hits the no-route path, the shared skb->cb storage is freed (or zeroed) before the RX_QUEUED handler reads rate statistics from it via sta_stats_encode_rate, corrupting kernel memory. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 6th percentile); the issue is a fixed upstream bug rather than an actively exploited one.

Local privilege-escalation-class use-after-free in the Linux kernel's VMware VMCI vsock transport (vsock/vmci) allows a local attacker to corrupt freed socket memory by resetting a connection during the vsock handshake. When a peer sends a VMCI RST packet, vmci_transport_recv_connecting_server() incorrectly returned success (err=0), so vsock_transport_recv_listen() skipped removing the pending socket; a deferred vsock_pending_work() then double-dropped the socket reference, freeing it and writing into the freed object (KASAN slab-use-after-free). CVSS is 8.8 with a scope change, but EPSS is low (0.18%, 8th percentile) and there is no public exploit identified at time of analysis and it is not in CISA KEV.

Use-after-free in the Linux kernel's ixgbevf driver (Intel 82599 SR-IOV virtual-function NIC driver) occurs when the VEPA multicast source-pruning workaround frees an skb and continues the receive loop without resetting the shared skb pointer to NULL, so the next descriptor iteration calls ixgbevf_add_rx_frag() on freed memory in NAPI softirq context. The flaw is present in ixgbevf's ixgbevf_clean_rx_irq() and affects VFs running in VEPA mode on hosts using the 82599/X520 family. There is no public exploit identified at time of analysis - the bug was located by static analysis (scan_drop_continue_loops.py / semgrep) and the UAF was confirmed under KASAN only via a synthetic test module reproducing the code pattern, not against real hardware; EPSS is low (0.18%, 7th percentile) and it is not on CISA KEV.

Use-after-free read in the Linux kernel's AF_UNIX stream socket handler (unix_stream_data_wait()) lets a local user leak or corrupt kernel memory state and potentially crash the system by racing a peeking recv() against a normal recv() on the same socket. The flaw affects kernels from ~6.5 onward, where unix_stream_data_wait() dereferences tail->len from an SKB read via skb_peek_tail() without a lock preventing that SKB from being concurrently dequeued and freed. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, though the fix commit includes a race reproducer; the issue is fixed in stable releases.

Use-after-free in the Linux kernel ISCI (Intel SAS) driver's device removal path allows a local attacker with low privileges to corrupt kernel memory by racing the completion tasklet against driver teardown, potentially enabling privilege escalation. Systems running affected kernel versions with Intel ISCI SAS hardware are vulnerable across multiple stable branches, with vendor-released fixes available in 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit has been identified and EPSS of 0.18% (7th percentile) confirms no observed widespread exploitation, though the KASAN-verified reproduction documented in the fix commit confirms the failure class is reliably triggerable under controlled conditions.

Local privilege escalation and memory corruption in the Linux kernel's drm/v3d GPU driver (Broadcom VideoCore, used in Raspberry Pi and similar SoCs) stems from a use-after-free on the CPU-job ioctl error path, where kvfree() reads the cpu_job structure after v3d_job_cleanup() has already dropped its last reference and freed it. The same faulty path also causes a NULL-pointer dereference on early init failure and leaks a drm_syncobj reference per query. No public exploit is identified at time of analysis, EPSS is low (0.18%), and it is not in CISA KEV, but a kernel UAF reachable by a local unprivileged user with GPU access carries high impact (CVSS 7.8).

Out-of-bounds read in the AMD display (amdgpu) driver of the Linux kernel occurs when the GPIO pin table parsers get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() trust the VBIOS table_header.structuresize field and iterate over gpio_pin[] entries without confirming the full claimed size is mapped. On a system with a malformed or oversized VBIOS structuresize, the loop reads past the end of the BIOS image, potentially disclosing adjacent kernel memory or crashing the driver. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and the issue is not listed in CISA KEV; a vendor patch is available across multiple stable trees.

Use-after-free in the Linux kernel's batman-adv (B.A.T.M.A.N. mesh routing) multicast code lets an adjacent attacker on the mesh trigger access to freed orig_node memory, potentially disclosing kernel memory or crashing the node. The flaw stems from batadv_mcast_purge_orig() removing entries from RCU-protected hlists without waiting for a grace period, so concurrent RCU readers dereference already-freed multicast node references. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.

Out-of-bounds heap write in the Linux kernel's ADM1266 PMBus power-sequencer hwmon driver allows a locally-privileged attacker - aided by a malicious or non-compliant ADM1266 device - to overflow kernel heap memory by up to 191 bytes, potentially achieving privilege escalation or kernel code execution. The root cause is a size-contract violation between adm1266_pmbus_block_xfer() (which trusts device-supplied lengths up to 255 bytes) and adm1266_nvmem_read_blackbox() (which allocates only 64-byte strides). No public exploit code has been identified at time of analysis; EPSS is 0.18%, consistent with low in-the-wild interest.

Out-of-bounds read and write in the Linux kernel's hwmon PMBus ADM1266 driver (adm1266_gpio_get_multiple) lets a local low-privileged user with access to the driver's GPIO interface corrupt adjacent kernel/caller stack memory, potentially leading to privilege escalation or a crash. The flaw stems from an incorrect loop bound (the PMBus command code 0xE9/233 was used instead of the 25-pin ADM1266_PDIO_NR limit), so the scan walks up to 242 bits and reads/writes past the caller-supplied mask and bits arrays. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile) and the CVE is not on CISA KEV.

Out-of-bounds read and oversized memory allocation in the Linux kernel's Arm Firmware Framework for A-profile (FF-A) driver (drivers/firmware/arm_ffa) arises from unvalidated offset and size fields in framework notification messages placed in the shared RX buffer. Malformed firmware-supplied data can drive an OOB read during UUID parsing or an oversized kmemdup() allocation, affecting kernels from 6.15 onward on Arm systems using FF-A. Rated CVSS 8.4 (local vector); no public exploit is identified and EPSS is low (0.17%), consistent with a firmware-trust-boundary issue rather than a broadly exploitable remote flaw.

Kernel memory corruption in the Linux arm_ffa (Arm Firmware Framework for A-profile) driver allows a local attacker to trigger a use-after-free by racing notifier unregistration against active notification delivery, affecting Arm systems running kernels from 6.15 up to the fixed 6.18.34/7.0.11 releases. Both the framework and non-framework notification handlers looked up a callback under notify_lock, dropped the lock, then dereferenced a notifier entry that a concurrent unregister could have already freed. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and it is not listed in CISA KEV.

Use-after-free in the Linux kernel's fprobe subsystem exposes kernel memory to corruption when a fprobe is released immediately after unregistration without waiting for an RCU grace period. The flaw was introduced by commit 4346ba1604093, which rewrote fprobe on the function-graph tracer and placed struct fprobe on an RCU-protected hlist but omitted the required synchronize_rcu() call in unregister_fprobe(), leaving a window where in-flight RCU readers may dereference freed memory. BPF users of fprobe are explicitly unaffected because BPF defers deallocation through the bpf_link_defer_dealloc_rcu_gp() RCU callback; affected paths are fprobe events and sample module code.

Local privilege-adjacent memory corruption in the Linux kernel's fs/statmount subsystem allows an authenticated local user to trigger a 1-byte NULL out-of-bounds write on a dynamically allocated seq buffer. The flaw lives in statmount_mnt_idmap(), which manually advances seq->count after seq_printf(); on overflow this desynchronizes the buffer accounting so seq_has_overflowed() misses the overflow and a later 'seq->buf[seq->count++] = 0' writes past the slab allocation. Rated CVSS 7.8 (High); EPSS is low (0.17%, 6th percentile), no public exploit or CISA KEV listing exists at time of analysis, and a vendor fix is available.

Use-after-free in the Linux kernel's irq_work subsystem allows a local attacker on a PREEMPT_RT (real-time) kernel to corrupt memory by racing irq_work_sync() against irq_work_single(). After the BUSY flag is cleared via atomic_cmpxchg(), the work object is still dereferenced for irq_work_is_hard() and rcuwait_wake_up(), while a concurrent irq_work_sync() caller on another CPU can observe BUSY==0, return, and free the object before those accesses complete. Rated CVSS 7.8 (High); no public exploit identified at time of analysis and EPSS probability is low (0.19%, 8th percentile).

Use-after-free (CWE-416) in the Linux kernel nvme-pci driver allows a local attacker or triggerable hardware condition to crash the kernel or potentially corrupt memory. The nvme_free_host_mem() function frees dev->hmb_sgt but never clears the pointer, so a double-call during an error path in nvme_probe() dereferences the freed and zeroed DMA structure, causing a NULL pointer dereference in iommu_dma_free_noncontiguous(). Observed reliably on Thunderbolt-attached NVMe devices with PCIe link instability; no public exploit or active exploitation identified at time of analysis.

Memory corruption in the Linux kernel netfs subsystem allows local authenticated users to corrupt kernel heap state via a crafted sequence of streaming write operations on network-backed filesystems, potentially enabling local privilege escalation to root. The bug resides in netfs_perform_write(): when a subsequent write fully overwrites a partially-dirty streaming-write folio, the netfs_folio struct that tracks the dirty byte region is neither freed nor correctly updated, leaving stale or inconsistent metadata that drives out-of-bounds writes (CWE-787) during later writeback processing. Patched versions are available across all active stable branches (6.12.92, 7.0.11, 7.1, 6.18.34); no public exploit or active exploitation has been identified at time of analysis.

Use-after-free memory corruption in the Linux kernel's netfs subsystem (netfs_read_gaps()) allows local activity on network filesystem mounts (notably the cifs/SMB client) to write into a prematurely-freed sink folio. The bug arises because the sink page backing an ITER_BVEC iterator is released before the outstanding read op completes, letting the cifsd receive thread copy incoming socket data into freed memory - reproduced by KASAN on the generic/075 xfstest. There is no public exploit identified at time of analysis and EPSS risk is low (0.17%); the vendor-supplied CVSS of 9.8 (AV:N) appears inflated for what is fundamentally a local, race-dependent kernel flaw.

Double-free memory corruption in the Linux kernel's net/shaper subsystem allows a local attacker with CAP_NET_ADMIN capability to corrupt the kernel heap by submitting a crafted GROUP netlink request containing duplicate leaf handles. Affected kernels span from the introduction of the net shaper subsystem (~6.13) through multiple stable branches, with fixes backported to 6.18.34, 7.0.11, and 7.1. No public exploit or active exploitation has been identified; vendor-released patches are available via kernel.org and distribution advisories such as Ubuntu USN-8593-1.

Local privilege-escalation via kernel memory corruption in the Linux accel/qaic driver (Qualcomm Cloud AI 100 accelerator) lets a user with access to the qaic device trigger a use-after-free by mapping a GEM buffer object (BO) larger than its VMA. The qaic_gem_object_mmap path called remap_pfn_range without bounding it to the VMA size, so an oversized BO mapped pages past the VMA; a later munmap() unmaps only the VMA and leaves stale mappings to freed pages. EPSS is low (0.17%, 6th percentile) with no public exploit and no KEV listing, but the C:H/I:H/A:H impact makes it a valid local escalation primitive on affected hardware.

Use-after-free in the Linux kernel's Qualcomm MSM Display Processing Unit (DPU) DRM driver arises because dpu_writeback_init() mixes device-managed (devm_) and DRM-managed (drmm_) allocation lifetimes. On driver teardown, the writeback connector's data is freed via devm while userspace still holds a reference to the drm device and can interact with the drmm-backed connector, creating a dangling pointer a local user can exploit. Rated CVSS 7.8 (local, low-privilege); EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis.

Local privilege escalation and memory corruption in the Linux kernel's ASoC fs210x audio codec driver arises from a misused strscpy() call in fs210x_effect_scene_info(), where the copy length was derived from the source string (strlen(SRC)+1) rather than the destination buffer size, allowing an overwrite when the source is at least as long as the destination. The flaw affects Linux 6.18 through the fixed stable releases and carries a CVSS of 7.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.

Use-after-free in the Linux kernel's RDMA/rtrs (RDMA Transport) server module allows corruption of freed memory during the error-cleanup path of rtrs_srv_create_path_files(). When sysfs path-file creation partially fails, cleanup calls kobject_put() (which can free srv_path via the rtrs_srv_release callback) before rtrs_srv_destroy_once_sysfs_root_folders() dereferences that now-freed structure. Reported upstream by Linux/kernel maintainers with a vendor patch available; there is no public exploit identified and EPSS exploitation probability is low (0.17%, 7th percentile), consistent with a hard-to-reach error path in a niche subsystem rather than a broadly weaponizable flaw.

Use-after-free in the Linux kernel's bridge multicast (br_multicast) subsystem lets a local user with network-configuration capability crash the host or potentially execute code by toggling global multicast snooping while per-VLAN multicast snooping is enabled on a VLAN-filtering bridge. The flawed logic can leave both per-port and per-{port, VLAN} multicast contexts active simultaneously, so a per-port context (including its query timer) survives after the bridge port is freed, yielding a UAF confirmed by kernel debug tooling (ODEBUG free-active). No public exploit has been identified and EPSS is low (0.17%), but a deterministic reproducer is included in the fix, and the CVSS is 7.8 (High).

Local information disclosure and memory corruption in the Linux kernel's rxrpc (AF_RXRPC/AFS) subsystem allows a local user of an encrypted rxrpc socket to trigger pagecache corruption because DATA packets were decrypted in-place on shared sk_buffs while splice() referenced the same pages. This is a hardening follow-up to CVE-2026-43500, replacing in-place decryption with a per-call bounce buffer so recvmsg() copies clean data and the sk_buff is never mutated. No public exploit identified at time of analysis, EPSS is low (0.17%, 6th percentile), and it is not listed in CISA KEV, consistent with a niche kernel subsystem rather than a mass-exploitation target.

Local privilege escalation and memory corruption in the Linux kernel GPIO aggregator driver (gpio-aggregator) arises from a use-after-free on the error-handling path, where `aggr->lookups->dev_id` is freed before the lookup entry is removed from the table. A concurrent thread calling `gpiod_find()` can then dereference the freed `dev_id` via `strcmp()` in `gpiod_match_lookup_table()`, yielding a UAF that a low-privileged local attacker could leverage for code execution or DoS. There is no public exploit identified at time of analysis, and EPSS is low (0.17%), consistent with a race-condition kernel bug requiring local access rather than a mass-exploitation candidate.