CVE-2026-64095 (GCVE-0-2026-64095)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-08-05 12:39
VLAI
Title
batman-adv: bla: avoid double decrement of bla.num_requests
Summary
In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double decrement of bla.num_requests The bla.num_requests is increased when no request_sent was in progress. And it is decremented in various places (announcement was received, backbone is purged, periodic work). But the check if the request_sent is actually set to a specific state and the atomic_dec/_inc are not safe because they are not atomic (TOCTOU) and multiple such code portions can run concurrently. At the same time, it is necessary to modify request_sent (state) and bla.num_requests atomically. Otherwise batadv_bla_send_request() might set request_sent to 1 and is interrupted. batadv_handle_announce() can then set request_sent back to 0 and decrement num_requests before batadv_bla_send_request() incremented it. The two operations must therefore be locked. And since state (request_sent) and wait_periods are only accessed inside this lock, they can be converted to simpler datatypes. And to avoid that the bla.num_requests is touched by a parallel running context with a valid backbone_gw reference after batadv_bla_purge_backbone_gw() ran, a third state "stopped" is required to correctly signal that a backbone_gw is in the state of being cleaned up.
Severity
7.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 23721387c409087fd3b97e274f34d3ddc0970b74 , < 1f013bc94154f2e78e97d0296175664224c796e0 (git)
Affected: 23721387c409087fd3b97e274f34d3ddc0970b74 , < 5328b95960774f2e189f22485616bc7b8eb2f7e3 (git)
Affected: 23721387c409087fd3b97e274f34d3ddc0970b74 , < 8ff9c59d1b7b48c2596878341a5310f32895d52b (git)
Affected: 23721387c409087fd3b97e274f34d3ddc0970b74 , < a9393751ecf7e9096f93cb6eed02db4f79125765 (git)
Affected: 23721387c409087fd3b97e274f34d3ddc0970b74 , < 461f1e3dfb888701895b766446c55db2b10db705 (git)
Affected: 23721387c409087fd3b97e274f34d3ddc0970b74 , < 45384612f29692fbf0c770200361a7acff90125c (git)
Affected: 23721387c409087fd3b97e274f34d3ddc0970b74 , < 65497ad155a3246df177b5ef662cd6e5a32cb470 (git)
Affected: 23721387c409087fd3b97e274f34d3ddc0970b74 , < 83ab69bd12b80f6ea169c8bea6977701b53a043d (git)
Create a notification for this product.
Linux Linux Affected: 3.5
Unaffected: 0 , < 3.5 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/bridge_loop_avoidance.c",
            "net/batman-adv/mesh-interface.c",
            "net/batman-adv/types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1f013bc94154f2e78e97d0296175664224c796e0",
              "status": "affected",
              "version": "23721387c409087fd3b97e274f34d3ddc0970b74",
              "versionType": "git"
            },
            {
              "lessThan": "5328b95960774f2e189f22485616bc7b8eb2f7e3",
              "status": "affected",
              "version": "23721387c409087fd3b97e274f34d3ddc0970b74",
              "versionType": "git"
            },
            {
              "lessThan": "8ff9c59d1b7b48c2596878341a5310f32895d52b",
              "status": "affected",
              "version": "23721387c409087fd3b97e274f34d3ddc0970b74",
              "versionType": "git"
            },
            {
              "lessThan": "a9393751ecf7e9096f93cb6eed02db4f79125765",
              "status": "affected",
              "version": "23721387c409087fd3b97e274f34d3ddc0970b74",
              "versionType": "git"
            },
            {
              "lessThan": "461f1e3dfb888701895b766446c55db2b10db705",
              "status": "affected",
              "version": "23721387c409087fd3b97e274f34d3ddc0970b74",
              "versionType": "git"
            },
            {
              "lessThan": "45384612f29692fbf0c770200361a7acff90125c",
              "status": "affected",
              "version": "23721387c409087fd3b97e274f34d3ddc0970b74",
              "versionType": "git"
            },
            {
              "lessThan": "65497ad155a3246df177b5ef662cd6e5a32cb470",
              "status": "affected",
              "version": "23721387c409087fd3b97e274f34d3ddc0970b74",
              "versionType": "git"
            },
            {
              "lessThan": "83ab69bd12b80f6ea169c8bea6977701b53a043d",
              "status": "affected",
              "version": "23721387c409087fd3b97e274f34d3ddc0970b74",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/bridge_loop_avoidance.c",
            "net/batman-adv/mesh-interface.c",
            "net/batman-adv/types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.5"
            },
            {
              "lessThan": "3.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: bla: avoid double decrement of bla.num_requests\n\nThe bla.num_requests is increased when no request_sent was in progress. And\nit is decremented in various places (announcement was received, backbone is\npurged, periodic work). But the check if the request_sent is actually set\nto a specific state and the atomic_dec/_inc are not safe because they are\nnot atomic (TOCTOU) and multiple such code portions can run concurrently.\n\nAt the same time, it is necessary to modify request_sent (state) and\nbla.num_requests atomically. Otherwise batadv_bla_send_request() might set\nrequest_sent to 1 and is interrupted.  batadv_handle_announce() can then\nset request_sent back to 0 and decrement num_requests before\nbatadv_bla_send_request() incremented it.\n\nThe two operations must therefore be locked. And since state (request_sent)\nand wait_periods are only accessed inside this lock, they can be converted\nto simpler datatypes. And to avoid that the bla.num_requests is touched by\na parallel running context with a valid backbone_gw reference after\nbatadv_bla_purge_backbone_gw() ran, a third state \"stopped\" is required to\ncorrectly signal that a backbone_gw is in the state of being cleaned up."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable BLA ANNOUNCE handling runs in batadv_bla_tx() when BLA ARP claim frames reach the batman-adv interface from an attached LAN segment, which is the intended BLA deployment (multiple mesh gateways on one Ethernet). This requires same-segment L2 adjacency, not arbitrary Internet reachability.\nAC:L - The TOCTOU race between request_sent checks and num_requests updates is attacker-influenceable by flooding crafted BLA ANNOUNCE frames with mismatched CRCs while concurrent periodic work and purge paths run. The attacker controls one side of the race via packet timing and volume.\nPR:N - Exploitation requires only the ability to inject valid BLA protocol frames onto the shared LAN or mesh segment as a peer backbone gateway, not root, CAP_NET_ADMIN, or any local privileges on the victim system.\nUI:N - No victim user action is required; the bug is triggered automatically when the attacker sends BLA frames that are processed by the victim\u0027s bridge-loop-avoidance code.\nS:U - The impact is confined to incorrect BLA state and packet forwarding on the victim\u0027s batman-adv mesh node within the same kernel/network security boundary, with no VM escape or cross-authority boundary crossing.\nC:N - The bug is an integer counter synchronization error with no out-of-bounds read, use-after-free, or other memory access that could disclose kernel data.\nI:L - A corrupted num_requests counter can prematurely clear the multicast gate and disable bridge-loop avoidance, allowing unintended broadcast forwarding and Ethernet bridge loops, but there is no kernel memory write or code-execution primitive.\nA:H - Counter underflow leaves num_requests permanently non-zero, indefinitely blocking all multicast/broadcast mesh traffic, and the opposite race can trigger sustained broadcast storms via bridge loops, causing total loss of mesh/LAN availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:09.386Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1f013bc94154f2e78e97d0296175664224c796e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/5328b95960774f2e189f22485616bc7b8eb2f7e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ff9c59d1b7b48c2596878341a5310f32895d52b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9393751ecf7e9096f93cb6eed02db4f79125765"
        },
        {
          "url": "https://git.kernel.org/stable/c/461f1e3dfb888701895b766446c55db2b10db705"
        },
        {
          "url": "https://git.kernel.org/stable/c/45384612f29692fbf0c770200361a7acff90125c"
        },
        {
          "url": "https://git.kernel.org/stable/c/65497ad155a3246df177b5ef662cd6e5a32cb470"
        },
        {
          "url": "https://git.kernel.org/stable/c/83ab69bd12b80f6ea169c8bea6977701b53a043d"
        }
      ],
      "title": "batman-adv: bla: avoid double decrement of bla.num_requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64095",
    "datePublished": "2026-07-19T15:40:02.360Z",
    "dateReserved": "2026-07-19T07:54:57.033Z",
    "dateUpdated": "2026-08-05T12:39:09.386Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64095",
      "date": "2026-08-10",
      "epss": "0.00267",
      "percentile": "0.1863"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64095\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:50.470\",\"lastModified\":\"2026-07-30T14:59:47.950\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbatman-adv: bla: avoid double decrement of bla.num_requests\\n\\nThe bla.num_requests is increased when no request_sent was in progress. And\\nit is decremented in various places (announcement was received, backbone is\\npurged, periodic work). But the check if the request_sent is actually set\\nto a specific state and the atomic_dec/_inc are not safe because they are\\nnot atomic (TOCTOU) and multiple such code portions can run concurrently.\\n\\nAt the same time, it is necessary to modify request_sent (state) and\\nbla.num_requests atomically. Otherwise batadv_bla_send_request() might set\\nrequest_sent to 1 and is interrupted.  batadv_handle_announce() can then\\nset request_sent back to 0 and decrement num_requests before\\nbatadv_bla_send_request() incremented it.\\n\\nThe two operations must therefore be locked. And since state (request_sent)\\nand wait_periods are only accessed inside this lock, they can be converted\\nto simpler datatypes. And to avoid that the bla.num_requests is touched by\\na parallel running context with a valid backbone_gw reference after\\nbatadv_bla_purge_backbone_gw() ran, a third state \\\"stopped\\\" is required to\\ncorrectly signal that a backbone_gw is in the state of being cleaned up.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/batman-adv/bridge_loop_avoidance.c\",\"net/batman-adv/mesh-interface.c\",\"net/batman-adv/types.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"23721387c409087fd3b97e274f34d3ddc0970b74\",\"lessThan\":\"1f013bc94154f2e78e97d0296175664224c796e0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"23721387c409087fd3b97e274f34d3ddc0970b74\",\"lessThan\":\"5328b95960774f2e189f22485616bc7b8eb2f7e3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"23721387c409087fd3b97e274f34d3ddc0970b74\",\"lessThan\":\"8ff9c59d1b7b48c2596878341a5310f32895d52b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"23721387c409087fd3b97e274f34d3ddc0970b74\",\"lessThan\":\"a9393751ecf7e9096f93cb6eed02db4f79125765\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"23721387c409087fd3b97e274f34d3ddc0970b74\",\"lessThan\":\"461f1e3dfb888701895b766446c55db2b10db705\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"23721387c409087fd3b97e274f34d3ddc0970b74\",\"lessThan\":\"45384612f29692fbf0c770200361a7acff90125c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"23721387c409087fd3b97e274f34d3ddc0970b74\",\"lessThan\":\"65497ad155a3246df177b5ef662cd6e5a32cb470\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"23721387c409087fd3b97e274f34d3ddc0970b74\",\"lessThan\":\"83ab69bd12b80f6ea169c8bea6977701b53a043d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/batman-adv/bridge_loop_avoidance.c\",\"net/batman-adv/mesh-interface.c\",\"net/batman-adv/types.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.259\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.210\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.143\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.93\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.34\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.11\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":4.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1f013bc94154f2e78e97d0296175664224c796e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/45384612f29692fbf0c770200361a7acff90125c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/461f1e3dfb888701895b766446c55db2b10db705\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5328b95960774f2e189f22485616bc7b8eb2f7e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/65497ad155a3246df177b5ef662cd6e5a32cb470\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/83ab69bd12b80f6ea169c8bea6977701b53a043d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8ff9c59d1b7b48c2596878341a5310f32895d52b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a9393751ecf7e9096f93cb6eed02db4f79125765\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-21T08:04:29+00:00",
      "cve": "CVE-2026-64095",
      "id": "CVE-2026-64095",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: batman-adv: bla: avoid double decrement of bla.num_requests",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64095.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:33:38Z",
      "cve": "CVE-2026-64095",
      "id": "CVE-2026-64095",
      "initial_release_date": "2026-07-21T12:59:47Z",
      "product_status:known_affected": "292",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64095",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64095.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.