GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80716 (GCVE-0-2026-80716)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:53 – Updated: 2026-08-29 06:22
VLAI
Title
ALSA: pcm: wake linked drain waiters on unlink
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink snd_pcm_drain() on a linked stream parks an on-stack wait entry on the drained peer's runtime->sleep, and after schedule_timeout() removes it only if that peer is still found in the caller's group. If group membership changes during the wait and the sleep ends by signal or timeout (so autoremove_wake_function() does not run), finish_wait() is skipped and snd_pcm_drain() returns with the entry still queued on that stream's sleep list; a later wake_up() then walks a freed stack frame. This is reachable by unlinking either the drained or the draining stream. Unlike the close path (snd_pcm_drop() -> snd_pcm_post_stop()), snd_pcm_unlink() never wakes the sleep queues. Wake every group member under the group lock before the membership change, so a linked drainer is released and drops its entry while the streams are still grouped. The window was opened when snd_pcm_link_rwsem stopped being held across the wait and the removal became conditional on group membership (see Fixes). The later switch to finish_wait() kept that conditional removal, so the signal/timeout case remained.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f57f3df03a8e6010e321fa0258d3e054713c3cb7 , < c172e4c53321ee6429955295ea133bc3597a3ca9 (git)
Affected: f57f3df03a8e6010e321fa0258d3e054713c3cb7 , < 3035bb784cea3f338934f5042dd3f35225a51b2e (git)
Affected: f57f3df03a8e6010e321fa0258d3e054713c3cb7 , < 1c1b7e8e545ce65e40f65b55c432765e058ea98f (git)
Affected: f57f3df03a8e6010e321fa0258d3e054713c3cb7 , < e8b784a3f4fba3ea9c4d05138ecfa784a069627f (git)
Affected: f57f3df03a8e6010e321fa0258d3e054713c3cb7 , < e8315330e4ec09c0cac625515400e13d0ee22b81 (git)
Affected: f57f3df03a8e6010e321fa0258d3e054713c3cb7 , < 2940cc3cf43c72126b74ee6376314c195382023a (git)
Affected: f57f3df03a8e6010e321fa0258d3e054713c3cb7 , < db09bc4ab19ce548a078240d2374792523953500 (git)
Affected: f57f3df03a8e6010e321fa0258d3e054713c3cb7 , < f495b6c4c8594122918552c9be2b51eb71647cd9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.1
Unaffected: 0 , < 5.1 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/core/pcm_native.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c172e4c53321ee6429955295ea133bc3597a3ca9",
              "status": "affected",
              "version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
              "versionType": "git"
            },
            {
              "lessThan": "3035bb784cea3f338934f5042dd3f35225a51b2e",
              "status": "affected",
              "version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
              "versionType": "git"
            },
            {
              "lessThan": "1c1b7e8e545ce65e40f65b55c432765e058ea98f",
              "status": "affected",
              "version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
              "versionType": "git"
            },
            {
              "lessThan": "e8b784a3f4fba3ea9c4d05138ecfa784a069627f",
              "status": "affected",
              "version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
              "versionType": "git"
            },
            {
              "lessThan": "e8315330e4ec09c0cac625515400e13d0ee22b81",
              "status": "affected",
              "version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
              "versionType": "git"
            },
            {
              "lessThan": "2940cc3cf43c72126b74ee6376314c195382023a",
              "status": "affected",
              "version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
              "versionType": "git"
            },
            {
              "lessThan": "db09bc4ab19ce548a078240d2374792523953500",
              "status": "affected",
              "version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
              "versionType": "git"
            },
            {
              "lessThan": "f495b6c4c8594122918552c9be2b51eb71647cd9",
              "status": "affected",
              "version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/core/pcm_native.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: wake linked drain waiters on unlink\n\nsnd_pcm_drain() on a linked stream parks an on-stack wait entry on the\ndrained peer\u0027s runtime-\u003esleep, and after schedule_timeout() removes it\nonly if that peer is still found in the caller\u0027s group.  If group\nmembership changes during the wait and the sleep ends by signal or\ntimeout (so autoremove_wake_function() does not run), finish_wait() is\nskipped and snd_pcm_drain() returns with the entry still queued on that\nstream\u0027s sleep list; a later wake_up() then walks a freed stack frame.\nThis is reachable by unlinking either the drained or the draining stream.\n\nUnlike the close path (snd_pcm_drop() -\u003e snd_pcm_post_stop()),\nsnd_pcm_unlink() never wakes the sleep queues.  Wake every group member\nunder the group lock before the membership change, so a linked drainer is\nreleased and drops its entry while the streams are still grouped.\n\nThe window was opened when snd_pcm_link_rwsem stopped being held across\nthe wait and the removal became conditional on group membership (see\nFixes). The later switch to finish_wait() kept that conditional removal,\nso the signal/timeout case remained."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered only via local ALSA PCM character devices (/dev/snd/pcmC*D*) through open/ioctl syscalls (SNDRV_PCM_IOCTL_LINK, UNLINK, DRAIN); snd_pcm_kernel_ioctl does not expose LINK/UNLINK, and there is no network-facing path to this code.\nAC:L - This is a race, but the attacker controls both sides by opening two PCM fds, linking them, blocking one thread in DRAIN, and concurrently UNLINKing or closing the peer; sending a signal or waiting for timeout forces the path where finish_wait() is skipped.\nPR:L - Exploitation requires only a local process able to open and ioctl ALSA PCM nodes (typical desktop/mobile users via the audio group, session ACLs, or equivalent device permissions); no real root, CAP_SYS_ADMIN, or init-namespace privileges are needed.\nUI:N - The attacker drives the entire sequence programmatically with their own PCM file descriptors and threads; no victim interaction such as opening a file, mounting a filesystem, or plugging in hardware is required.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same security authority; this is not a VM escape, IOMMU/DMA boundary bypass, or other cross-scope violation.\nC:H - The orphaned wait_queue_entry_t remains on the sleep list after snd_pcm_drain() returns, and a later wake_up() dereferences a freed on-stack wait entry (use-after-free), which can expose kernel stack/memory contents under attacker-controlled timing.\nI:H - Corrupting the wait-queue list with a stale stack-backed entry gives kernel memory corruption primitives; wake_up() invokes the entry\u0027s function pointer from freed stack memory, enabling plausible control-flow hijack and arbitrary write via further heap/stack grooming.\nA:H - A subsequent wake_up() on the poisoned sleep queue walks a freed stack frame and can oops or panic the kernel; even without full exploitation, the UAF reliably threatens system availability on multimedia desktops, kiosks, and embedded devices with ALSA access."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:22:32.041Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c172e4c53321ee6429955295ea133bc3597a3ca9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3035bb784cea3f338934f5042dd3f35225a51b2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c1b7e8e545ce65e40f65b55c432765e058ea98f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8b784a3f4fba3ea9c4d05138ecfa784a069627f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8315330e4ec09c0cac625515400e13d0ee22b81"
        },
        {
          "url": "https://git.kernel.org/stable/c/2940cc3cf43c72126b74ee6376314c195382023a"
        },
        {
          "url": "https://git.kernel.org/stable/c/db09bc4ab19ce548a078240d2374792523953500"
        },
        {
          "url": "https://git.kernel.org/stable/c/f495b6c4c8594122918552c9be2b51eb71647cd9"
        }
      ],
      "title": "ALSA: pcm: wake linked drain waiters on unlink",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80716",
    "datePublished": "2026-08-28T06:53:14.286Z",
    "dateReserved": "2026-08-26T14:34:25.788Z",
    "dateUpdated": "2026-08-29T06:22:32.041Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80716",
      "date": "2026-09-16",
      "epss": "0.0012",
      "percentile": "0.02102"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80716\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:57.303\",\"lastModified\":\"2026-08-29T07:16:53.027\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: pcm: wake linked drain waiters on unlink\\n\\nsnd_pcm_drain() on a linked stream parks an on-stack wait entry on the\\ndrained peer\u0027s runtime-\u003esleep, and after schedule_timeout() removes it\\nonly if that peer is still found in the caller\u0027s group.  If group\\nmembership changes during the wait and the sleep ends by signal or\\ntimeout (so autoremove_wake_function() does not run), finish_wait() is\\nskipped and snd_pcm_drain() returns with the entry still queued on that\\nstream\u0027s sleep list; a later wake_up() then walks a freed stack frame.\\nThis is reachable by unlinking either the drained or the draining stream.\\n\\nUnlike the close path (snd_pcm_drop() -\u003e snd_pcm_post_stop()),\\nsnd_pcm_unlink() never wakes the sleep queues.  Wake every group member\\nunder the group lock before the membership change, so a linked drainer is\\nreleased and drops its entry while the streams are still grouped.\\n\\nThe window was opened when snd_pcm_link_rwsem stopped being held across\\nthe wait and the removal became conditional on group membership (see\\nFixes). The later switch to finish_wait() kept that conditional removal,\\nso the signal/timeout case remained.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"sound/core/pcm_native.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f57f3df03a8e6010e321fa0258d3e054713c3cb7\",\"lessThan\":\"c172e4c53321ee6429955295ea133bc3597a3ca9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f57f3df03a8e6010e321fa0258d3e054713c3cb7\",\"lessThan\":\"3035bb784cea3f338934f5042dd3f35225a51b2e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f57f3df03a8e6010e321fa0258d3e054713c3cb7\",\"lessThan\":\"1c1b7e8e545ce65e40f65b55c432765e058ea98f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f57f3df03a8e6010e321fa0258d3e054713c3cb7\",\"lessThan\":\"e8b784a3f4fba3ea9c4d05138ecfa784a069627f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f57f3df03a8e6010e321fa0258d3e054713c3cb7\",\"lessThan\":\"e8315330e4ec09c0cac625515400e13d0ee22b81\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f57f3df03a8e6010e321fa0258d3e054713c3cb7\",\"lessThan\":\"2940cc3cf43c72126b74ee6376314c195382023a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f57f3df03a8e6010e321fa0258d3e054713c3cb7\",\"lessThan\":\"db09bc4ab19ce548a078240d2374792523953500\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f57f3df03a8e6010e321fa0258d3e054713c3cb7\",\"lessThan\":\"f495b6c4c8594122918552c9be2b51eb71647cd9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"sound/core/pcm_native.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.151\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.103\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1c1b7e8e545ce65e40f65b55c432765e058ea98f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2940cc3cf43c72126b74ee6376314c195382023a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3035bb784cea3f338934f5042dd3f35225a51b2e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c172e4c53321ee6429955295ea133bc3597a3ca9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/db09bc4ab19ce548a078240d2374792523953500\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e8315330e4ec09c0cac625515400e13d0ee22b81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e8b784a3f4fba3ea9c4d05138ecfa784a069627f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f495b6c4c8594122918552c9be2b51eb71647cd9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-01T10:37:03+00:00",
      "cve": "CVE-2026-80716",
      "id": "CVE-2026-80716",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ALSA: pcm: wake linked drain waiters on unlink",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80716.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:09:32Z",
      "cve": "CVE-2026-80716",
      "id": "CVE-2026-80716",
      "initial_release_date": "2026-08-28T16:33:13Z",
      "product_status:first_fixed": "69",
      "product_status:known_affected": "176",
      "product_status:known_not_affected": "177",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80716",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80716.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.