GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89894 (GCVE-0-2026-89894)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:31 – Updated: 2026-09-16 14:39
VLAI
Title
media: cx231xx: reject geometry changes while the VBI queue is busy
Summary
In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide dev->width / dev->norm but only refuse the change when the *video* queue (dev->vidq) is busy. The VBI queue (dev->vbiq) shares that same geometry: cx231xx_init_vbi_isoc() latches dma_q->lines_per_field from dev->norm, the VBI videobuf2 plane is sized from dev->width / dev->norm in vbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then recomputes the destination offset from the *live* dev->width and the latched lines_per_field on every URB completion: offset = lines_completed * (dev->width << 1) + ...; if (dma_q->current_field == 2) offset += dev->width * 2 * dma_q->lines_per_field; memcpy(plane + offset, p_buffer, lencopy); Because the VBI node shares video_ioctl_ops with the video node, an application can size a small VBI plane (REQBUFS/QBUF with a small width, or with the NTSC standard), then enlarge dev->width (or switch dev->norm to PAL) through the video node while the VBI stream is running -- the change is allowed because only dev->vidq is checked -- and let the device deliver a field-2 VBI payload. cx231xx_do_vbi_copy() now computes the offset with the larger geometry and memcpy()s past the end of the smaller plane that was already allocated, a heap out-of-bounds write whose offset is attacker-chosen and whose contents come from the device. The per-field guard in cx231xx_copy_vbi_line() does not help: it bounds the copy against the latched lines_per_field, not the plane's real capacity, and vb2 does not re-run buf_prepare() for an already prepared buffer. Refuse the format/standard change when the VBI queue is busy as well, so the geometry cannot change underneath an allocated VBI buffer.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab , < aa3314506deb9703bcf0e889db08959440228fbf (git)
Affected: 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab , < 90d50648af36a1fbf5dbc99238de6fd0e58a13e0 (git)
Affected: 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab , < a5dd3d7fba358ff9486f3f51b2a9038348c0970a (git)
Affected: 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab , < 54ac6df8b8d97eddc3ae97fd2045bdedc8541b6d (git)
Affected: 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab , < 1d1079db8d1807e259a1d2679ed314949797aad9 (git)
Affected: 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab , < 7087bef6510c7df5df0b19192633b8ecc0f33a6f (git)
Affected: 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab , < a636c72c7f522d984fa498fc0631f33a2d0be3fd (git)
Affected: 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab , < 627a121c15fe05a541f44d86016294b80bada75d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/usb/cx231xx/cx231xx-video.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aa3314506deb9703bcf0e889db08959440228fbf",
              "status": "affected",
              "version": "7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab",
              "versionType": "git"
            },
            {
              "lessThan": "90d50648af36a1fbf5dbc99238de6fd0e58a13e0",
              "status": "affected",
              "version": "7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab",
              "versionType": "git"
            },
            {
              "lessThan": "a5dd3d7fba358ff9486f3f51b2a9038348c0970a",
              "status": "affected",
              "version": "7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab",
              "versionType": "git"
            },
            {
              "lessThan": "54ac6df8b8d97eddc3ae97fd2045bdedc8541b6d",
              "status": "affected",
              "version": "7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab",
              "versionType": "git"
            },
            {
              "lessThan": "1d1079db8d1807e259a1d2679ed314949797aad9",
              "status": "affected",
              "version": "7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab",
              "versionType": "git"
            },
            {
              "lessThan": "7087bef6510c7df5df0b19192633b8ecc0f33a6f",
              "status": "affected",
              "version": "7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab",
              "versionType": "git"
            },
            {
              "lessThan": "a636c72c7f522d984fa498fc0631f33a2d0be3fd",
              "status": "affected",
              "version": "7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab",
              "versionType": "git"
            },
            {
              "lessThan": "627a121c15fe05a541f44d86016294b80bada75d",
              "status": "affected",
              "version": "7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/usb/cx231xx/cx231xx-video.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx231xx: reject geometry changes while the VBI queue is busy\n\nvidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide\ndev-\u003ewidth / dev-\u003enorm but only refuse the change when the *video* queue\n(dev-\u003evidq) is busy. The VBI queue (dev-\u003evbiq) shares that same geometry:\ncx231xx_init_vbi_isoc() latches dma_q-\u003elines_per_field from dev-\u003enorm,\nthe VBI videobuf2 plane is sized from dev-\u003ewidth / dev-\u003enorm in\nvbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then\nrecomputes the destination offset from the *live* dev-\u003ewidth and the\nlatched lines_per_field on every URB completion:\n\n\toffset = lines_completed * (dev-\u003ewidth \u003c\u003c 1) + ...;\n\tif (dma_q-\u003ecurrent_field == 2)\n\t\toffset += dev-\u003ewidth * 2 * dma_q-\u003elines_per_field;\n\tmemcpy(plane + offset, p_buffer, lencopy);\n\nBecause the VBI node shares video_ioctl_ops with the video node, an\napplication can size a small VBI plane (REQBUFS/QBUF with a small width,\nor with the NTSC standard), then enlarge dev-\u003ewidth (or switch dev-\u003enorm\nto PAL) through the video node while the VBI stream is running -- the\nchange is allowed because only dev-\u003evidq is checked -- and let the device\ndeliver a field-2 VBI payload. cx231xx_do_vbi_copy() now computes the\noffset with the larger geometry and memcpy()s past the end of the smaller\nplane that was already allocated, a heap out-of-bounds write whose offset\nis attacker-chosen and whose contents come from the device. The\nper-field guard in cx231xx_copy_vbi_line() does not help: it bounds the\ncopy against the latched lines_per_field, not the plane\u0027s real capacity,\nand vb2 does not re-run buf_prepare() for an already prepared buffer.\n\nRefuse the format/standard change when the VBI queue is busy as well, so\nthe geometry cannot change underneath an allocated VBI buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is reached only through local V4L2 ioctls (VIDIOC_S_FMT/VIDIOC_S_STD plus REQBUFS/QBUF/STREAMON) on the cx231xx /dev/videoN and /dev/vbiN nodes. A USB capture stick being present is a hardware precondition; the attacker does not inject USB packets, so the path is Local rather than Physical.\nAC:L - The attacker fully controls the sequence: shrink width via VIDIOC_S_FMT, allocate a small VBI plane, STREAMON, then enlarge width or switch standard on the video node while only vidq was checked. Subsequent URB completions copy field-2 VBI with the new geometry into the old plane with no race or layout outside the attacker\u0027s control.\nPR:L - cx231xx_v4l2_open(), vidioc_s_fmt_vid_cap(), and vidioc_s_std() perform no capability checks. Triggering the bug needs only an unprivileged local user who can open the V4L2 nodes, which udev grants via the video group and uaccess/logind (or the Android camera context), not init-namespace root.\nUI:N - The attacking process opens /dev/videoN and /dev/vbiN and issues the ioctl sequence itself. No separate victim action such as plugging in a device, mounting a filesystem, or running a privileged helper is required.\nS:U - The out-of-bounds memcpy corrupts kernel vmalloc memory belonging to the same host kernel. Impact is local privilege-escalation or denial of service within one security authority, not a VM escape, IOMMU bypass, or other cross-boundary effect.\nC:H - cx231xx_do_vbi_copy() memcpy()s past the undersized VBI plane at an attacker-chosen offset derived from the new width and latched lines_per_field. That heap out-of-bounds write can smash adjacent vmalloc objects and is leverageable for a kernel read primitive.\nI:H - The same attacker-chosen-offset heap out-of-bounds write overwrites kernel memory after the VBI buffer on every field-2 URB completion. An out-of-bounds write of this form is sufficient for control-flow hijacking and an arbitrary write primitive.\nA:H - memcpy() past the allocated VBI plane faults on a vmalloc guard page or corrupts adjacent kernel memory, producing a kernel oops or panic from URB completion context and taking down the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:45.161Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aa3314506deb9703bcf0e889db08959440228fbf"
        },
        {
          "url": "https://git.kernel.org/stable/c/90d50648af36a1fbf5dbc99238de6fd0e58a13e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5dd3d7fba358ff9486f3f51b2a9038348c0970a"
        },
        {
          "url": "https://git.kernel.org/stable/c/54ac6df8b8d97eddc3ae97fd2045bdedc8541b6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d1079db8d1807e259a1d2679ed314949797aad9"
        },
        {
          "url": "https://git.kernel.org/stable/c/7087bef6510c7df5df0b19192633b8ecc0f33a6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a636c72c7f522d984fa498fc0631f33a2d0be3fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/627a121c15fe05a541f44d86016294b80bada75d"
        }
      ],
      "title": "media: cx231xx: reject geometry changes while the VBI queue is busy",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89894",
    "datePublished": "2026-09-16T10:31:56.101Z",
    "dateReserved": "2026-09-11T19:38:34.773Z",
    "dateUpdated": "2026-09-16T14:39:45.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "microsoft_vex": {
      "current_release_date": "2026-09-17T01:04:50.000Z",
      "cve": "CVE-2026-89894",
      "id": "msrc_CVE-2026-89894",
      "initial_release_date": "2026-09-17T01:04:50.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "media: cx231xx: reject geometry changes while the VBI queue is busy",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89894.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89894\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-16T11:16:58.127\",\"lastModified\":\"2026-09-16T15:18:15.790\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: cx231xx: reject geometry changes while the VBI queue is busy\\n\\nvidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide\\ndev-\u003ewidth / dev-\u003enorm but only refuse the change when the *video* queue\\n(dev-\u003evidq) is busy. The VBI queue (dev-\u003evbiq) shares that same geometry:\\ncx231xx_init_vbi_isoc() latches dma_q-\u003elines_per_field from dev-\u003enorm,\\nthe VBI videobuf2 plane is sized from dev-\u003ewidth / dev-\u003enorm in\\nvbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then\\nrecomputes the destination offset from the *live* dev-\u003ewidth and the\\nlatched lines_per_field on every URB completion:\\n\\n\\toffset = lines_completed * (dev-\u003ewidth \u003c\u003c 1) + ...;\\n\\tif (dma_q-\u003ecurrent_field == 2)\\n\\t\\toffset += dev-\u003ewidth * 2 * dma_q-\u003elines_per_field;\\n\\tmemcpy(plane + offset, p_buffer, lencopy);\\n\\nBecause the VBI node shares video_ioctl_ops with the video node, an\\napplication can size a small VBI plane (REQBUFS/QBUF with a small width,\\nor with the NTSC standard), then enlarge dev-\u003ewidth (or switch dev-\u003enorm\\nto PAL) through the video node while the VBI stream is running -- the\\nchange is allowed because only dev-\u003evidq is checked -- and let the device\\ndeliver a field-2 VBI payload. cx231xx_do_vbi_copy() now computes the\\noffset with the larger geometry and memcpy()s past the end of the smaller\\nplane that was already allocated, a heap out-of-bounds write whose offset\\nis attacker-chosen and whose contents come from the device. The\\nper-field guard in cx231xx_copy_vbi_line() does not help: it bounds the\\ncopy against the latched lines_per_field, not the plane\u0027s real capacity,\\nand vb2 does not re-run buf_prepare() for an already prepared buffer.\\n\\nRefuse the format/standard change when the VBI queue is busy as well, so\\nthe geometry cannot change underneath an allocated VBI buffer.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/media/usb/cx231xx/cx231xx-video.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab\",\"lessThan\":\"aa3314506deb9703bcf0e889db08959440228fbf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab\",\"lessThan\":\"90d50648af36a1fbf5dbc99238de6fd0e58a13e0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab\",\"lessThan\":\"a5dd3d7fba358ff9486f3f51b2a9038348c0970a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab\",\"lessThan\":\"54ac6df8b8d97eddc3ae97fd2045bdedc8541b6d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab\",\"lessThan\":\"1d1079db8d1807e259a1d2679ed314949797aad9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab\",\"lessThan\":\"7087bef6510c7df5df0b19192633b8ecc0f33a6f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab\",\"lessThan\":\"a636c72c7f522d984fa498fc0631f33a2d0be3fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab\",\"lessThan\":\"627a121c15fe05a541f44d86016294b80bada75d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/media/usb/cx231xx/cx231xx-video.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.110\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.5\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1d1079db8d1807e259a1d2679ed314949797aad9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/54ac6df8b8d97eddc3ae97fd2045bdedc8541b6d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/627a121c15fe05a541f44d86016294b80bada75d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7087bef6510c7df5df0b19192633b8ecc0f33a6f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/90d50648af36a1fbf5dbc99238de6fd0e58a13e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a5dd3d7fba358ff9486f3f51b2a9038348c0970a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a636c72c7f522d984fa498fc0631f33a2d0be3fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aa3314506deb9703bcf0e889db08959440228fbf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.