GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89999 (GCVE-0-2026-89999)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
Title
HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacom_intuos_pro2_bt_irq wacom_intuos_pro2_bt_irq() receives the wire report length in `len` but never consults it before parsing. After the report-id gate it unconditionally calls wacom_intuos_pro2_bt_pen() and then, selected by features.type, a fixed chain of sub-parsers, none of which receive `len`: wacom_intuos_pro2_bt_pen(wacom); if (type == INTUOSP2_BT || type == INTUOSP2S_BT) { wacom_intuos_pro2_bt_touch(wacom); wacom_intuos_pro2_bt_pad(wacom); wacom_intuos_pro2_bt_battery(wacom); } else { wacom_intuos_gen3_bt_pad(wacom); wacom_intuos_gen3_bt_battery(wacom); } Each sub-parser dereferences wacom->data at fixed offsets. The furthest byte touched on each branch is: INTUOSP2_BT / INTUOSP2S_BT: wacom_intuos_pro2_bt_pad() reads data[285] (the touchring byte), so the report must be at least 286 bytes; INTUOSHT3_BT ("gen3"): wacom_intuos_gen3_bt_battery() reads data[45], so the report must be at least 46 bytes. features.type is selected from the VID/PID id_table entry and wacom_setup_device_quirks() force-registers the pen/pad/touch inputs for that type independent of the report descriptor, so a malicious or malfunctioning paired/spoofed Bluetooth peripheral can advertise that VID/PID and send an undersized report that still satisfies the data[0] == 0x80/0x81 gate. The driver then reads past the received report and forwards the bytes to userspace via evdev (MSC_SERIAL / ABS_MISC / ABS_WHEEL on the pen and pad input nodes), an out-of-bounds read with a concrete userspace read-back channel, and a true out-of-bounds read on transports whose backing buffer is sized to the (small) report descriptor rather than a fixed-size staging buffer. This is the same class of bug commit 2f1763f62909 ("HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq") already hardened in the sibling wacom_intuos_bt_irq(), which guards each report id against its minimum length before parsing. Guard wacom_intuos_pro2_bt_irq() the same way: before parsing, reject reports shorter than the furthest offset the selected branch actually dereferences, warn, and bail out. Because the whole pen/touch/pad/ battery chain runs unconditionally per branch, a single up-front check against the maximum offset (286 bytes for INTUOSP2_BT/INTUOSP2S_BT, 46 bytes for the gen3 branch) bounds every sub-parser. Returning 0 on a short report also skips those calls for the same malformed report, which is the safe, conservative behavior.
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b , < d2844f3fcd058113acbe0aa110ab13ef28b98d9f (git)
Affected: 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b , < 1bfc0547b81d5861443420d19b5ed2fd533cd17f (git)
Affected: 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b , < 84781a1f3c5dc6650480be9329e6e8528939eaa0 (git)
Affected: 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b , < 96dd0af7597aba2d80cc97e2f66e8b72d30ba125 (git)
Affected: 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b , < 114af803e409a68e52516810ecd24df4d8ce0c68 (git)
Affected: 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b , < 74ec08f7b81c2726578039ca6dea0fec136c38ea (git)
Affected: 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b , < 0cdc6cb242dd8d2731956fdf3390de094482a4b2 (git)
Affected: 4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b , < a8e04f3f894ccb52cfcd7e60125a9f35da4a616d (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/wacom_wac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d2844f3fcd058113acbe0aa110ab13ef28b98d9f",
              "status": "affected",
              "version": "4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b",
              "versionType": "git"
            },
            {
              "lessThan": "1bfc0547b81d5861443420d19b5ed2fd533cd17f",
              "status": "affected",
              "version": "4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b",
              "versionType": "git"
            },
            {
              "lessThan": "84781a1f3c5dc6650480be9329e6e8528939eaa0",
              "status": "affected",
              "version": "4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b",
              "versionType": "git"
            },
            {
              "lessThan": "96dd0af7597aba2d80cc97e2f66e8b72d30ba125",
              "status": "affected",
              "version": "4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b",
              "versionType": "git"
            },
            {
              "lessThan": "114af803e409a68e52516810ecd24df4d8ce0c68",
              "status": "affected",
              "version": "4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b",
              "versionType": "git"
            },
            {
              "lessThan": "74ec08f7b81c2726578039ca6dea0fec136c38ea",
              "status": "affected",
              "version": "4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b",
              "versionType": "git"
            },
            {
              "lessThan": "0cdc6cb242dd8d2731956fdf3390de094482a4b2",
              "status": "affected",
              "version": "4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b",
              "versionType": "git"
            },
            {
              "lessThan": "a8e04f3f894ccb52cfcd7e60125a9f35da4a616d",
              "status": "affected",
              "version": "4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/wacom_wac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc2",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: validate report length in wacom_intuos_pro2_bt_irq\n\nwacom_intuos_pro2_bt_irq() receives the wire report length in `len`\nbut never consults it before parsing. After the report-id gate it\nunconditionally calls wacom_intuos_pro2_bt_pen() and then, selected by\nfeatures.type, a fixed chain of sub-parsers, none of which receive\n`len`:\n\n\twacom_intuos_pro2_bt_pen(wacom);\n\tif (type == INTUOSP2_BT || type == INTUOSP2S_BT) {\n\t\twacom_intuos_pro2_bt_touch(wacom);\n\t\twacom_intuos_pro2_bt_pad(wacom);\n\t\twacom_intuos_pro2_bt_battery(wacom);\n\t} else {\n\t\twacom_intuos_gen3_bt_pad(wacom);\n\t\twacom_intuos_gen3_bt_battery(wacom);\n\t}\n\nEach sub-parser dereferences wacom-\u003edata at fixed offsets. The furthest\nbyte touched on each branch is:\n\n  INTUOSP2_BT / INTUOSP2S_BT: wacom_intuos_pro2_bt_pad() reads data[285]\n\t(the touchring byte), so the report must be at least 286 bytes;\n  INTUOSHT3_BT (\"gen3\"): wacom_intuos_gen3_bt_battery() reads data[45],\n\tso the report must be at least 46 bytes.\n\nfeatures.type is selected from the VID/PID id_table entry and\nwacom_setup_device_quirks() force-registers the pen/pad/touch inputs\nfor that type independent of the report descriptor, so a malicious or\nmalfunctioning paired/spoofed Bluetooth peripheral can advertise that\nVID/PID and send an undersized report that still satisfies the\ndata[0] == 0x80/0x81 gate. The driver then reads past the received\nreport and forwards the bytes to userspace via evdev (MSC_SERIAL /\nABS_MISC / ABS_WHEEL on the pen and pad input nodes), an out-of-bounds\nread with a concrete userspace read-back channel, and a true\nout-of-bounds read on transports whose backing buffer is sized to the\n(small) report descriptor rather than a fixed-size staging buffer.\n\nThis is the same class of bug commit 2f1763f62909 (\"HID: wacom: fix\nout-of-bounds read in wacom_intuos_bt_irq\") already hardened in the\nsibling wacom_intuos_bt_irq(), which guards each report id against its\nminimum length before parsing.\n\nGuard wacom_intuos_pro2_bt_irq() the same way: before parsing, reject\nreports shorter than the furthest offset the selected branch actually\ndereferences, warn, and bail out. Because the whole pen/touch/pad/\nbattery chain runs unconditionally per branch, a single up-front check\nagainst the maximum offset (286 bytes for INTUOSP2_BT/INTUOSP2S_BT,\n46 bytes for the gen3 branch) bounds every sub-parser. Returning 0 on\na short report also skips those calls for the same malformed report,\nwhich is the safe, conservative behavior."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - wacom_intuos_pro2_bt_irq() is reached only for BUS_BLUETOOTH Wacom Intuos Pro/HT3 devices (VID 0x056a, PIDs 0x360/0x361/0x377/0x379/0x393/0x3c6/0x3c8/0x3dd) via hidp/uhid HID input reports over L2CAP, so the attacker must be a Bluetooth HID peer on the same radio segment.\nAC:L - The attacker fully controls the HID report ID, descriptor, and wire length; any report with data[0]==0x80/0x81 that hid_get_report() accepts is parsed at fixed offsets with no length check, so a short report reliably triggers the OOB read.\nPR:N - The attacker is the Bluetooth HID peripheral sending input reports and needs no local account or capability; BlueZ/hidp connection setup is a host-side management path, not a privilege required of the reporting device.\nUI:N - After a paired, spoofed, or already-connected Intuos Pro/HT3 Bluetooth HID session exists, the peer can emit the short 0x80/0x81 report on the interrupt channel without further victim clicks, pairing prompts, or mounts.\nS:U - The Wacom HID parser and the resulting kernel/input/power_supply impact remain under the same host kernel security authority, with no VM escape, IOMMU/DMA bypass, or other cross-boundary effect.\nC:H - The parsers read wacom-\u003edata at fixed offsets through data[285] (286 bytes) ignoring len, which is a kernel OOB read, and those bytes are reported to userspace via evdev (MSC_SERIAL, ABS_MISC, ABS_WHEEL, pen/touch axes), a concrete disclosure channel.\nI:N - The defect is an out-of-bounds read of the HID report buffer, not an OOB write or UAF, and it does not yield an attacker-controlled kernel memory modification or control-flow hijack primitive.\nA:H - Reading hundreds of bytes past a short HID report can fault when the transport buffer is sized to the received report or descriptor rather than a large staging buffer, and an adjacent peer can repeat the malformed report to panic or oops the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:41:14.594Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d2844f3fcd058113acbe0aa110ab13ef28b98d9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bfc0547b81d5861443420d19b5ed2fd533cd17f"
        },
        {
          "url": "https://git.kernel.org/stable/c/84781a1f3c5dc6650480be9329e6e8528939eaa0"
        },
        {
          "url": "https://git.kernel.org/stable/c/96dd0af7597aba2d80cc97e2f66e8b72d30ba125"
        },
        {
          "url": "https://git.kernel.org/stable/c/114af803e409a68e52516810ecd24df4d8ce0c68"
        },
        {
          "url": "https://git.kernel.org/stable/c/74ec08f7b81c2726578039ca6dea0fec136c38ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/0cdc6cb242dd8d2731956fdf3390de094482a4b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8e04f3f894ccb52cfcd7e60125a9f35da4a616d"
        }
      ],
      "title": "HID: wacom: validate report length in wacom_intuos_pro2_bt_irq",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89999",
    "datePublished": "2026-09-16T10:33:10.683Z",
    "dateReserved": "2026-09-11T19:38:34.780Z",
    "dateUpdated": "2026-09-16T14:41:14.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89999\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-16T11:17:11.177\",\"lastModified\":\"2026-09-16T15:18:23.543\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nHID: wacom: validate report length in wacom_intuos_pro2_bt_irq\\n\\nwacom_intuos_pro2_bt_irq() receives the wire report length in `len`\\nbut never consults it before parsing. After the report-id gate it\\nunconditionally calls wacom_intuos_pro2_bt_pen() and then, selected by\\nfeatures.type, a fixed chain of sub-parsers, none of which receive\\n`len`:\\n\\n\\twacom_intuos_pro2_bt_pen(wacom);\\n\\tif (type == INTUOSP2_BT || type == INTUOSP2S_BT) {\\n\\t\\twacom_intuos_pro2_bt_touch(wacom);\\n\\t\\twacom_intuos_pro2_bt_pad(wacom);\\n\\t\\twacom_intuos_pro2_bt_battery(wacom);\\n\\t} else {\\n\\t\\twacom_intuos_gen3_bt_pad(wacom);\\n\\t\\twacom_intuos_gen3_bt_battery(wacom);\\n\\t}\\n\\nEach sub-parser dereferences wacom-\u003edata at fixed offsets. The furthest\\nbyte touched on each branch is:\\n\\n  INTUOSP2_BT / INTUOSP2S_BT: wacom_intuos_pro2_bt_pad() reads data[285]\\n\\t(the touchring byte), so the report must be at least 286 bytes;\\n  INTUOSHT3_BT (\\\"gen3\\\"): wacom_intuos_gen3_bt_battery() reads data[45],\\n\\tso the report must be at least 46 bytes.\\n\\nfeatures.type is selected from the VID/PID id_table entry and\\nwacom_setup_device_quirks() force-registers the pen/pad/touch inputs\\nfor that type independent of the report descriptor, so a malicious or\\nmalfunctioning paired/spoofed Bluetooth peripheral can advertise that\\nVID/PID and send an undersized report that still satisfies the\\ndata[0] == 0x80/0x81 gate. The driver then reads past the received\\nreport and forwards the bytes to userspace via evdev (MSC_SERIAL /\\nABS_MISC / ABS_WHEEL on the pen and pad input nodes), an out-of-bounds\\nread with a concrete userspace read-back channel, and a true\\nout-of-bounds read on transports whose backing buffer is sized to the\\n(small) report descriptor rather than a fixed-size staging buffer.\\n\\nThis is the same class of bug commit 2f1763f62909 (\\\"HID: wacom: fix\\nout-of-bounds read in wacom_intuos_bt_irq\\\") already hardened in the\\nsibling wacom_intuos_bt_irq(), which guards each report id against its\\nminimum length before parsing.\\n\\nGuard wacom_intuos_pro2_bt_irq() the same way: before parsing, reject\\nreports shorter than the furthest offset the selected branch actually\\ndereferences, warn, and bail out. Because the whole pen/touch/pad/\\nbattery chain runs unconditionally per branch, a single up-front check\\nagainst the maximum offset (286 bytes for INTUOSP2_BT/INTUOSP2S_BT,\\n46 bytes for the gen3 branch) bounds every sub-parser. Returning 0 on\\na short report also skips those calls for the same malformed report,\\nwhich is the safe, conservative behavior.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/hid/wacom_wac.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b\",\"lessThan\":\"d2844f3fcd058113acbe0aa110ab13ef28b98d9f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b\",\"lessThan\":\"1bfc0547b81d5861443420d19b5ed2fd533cd17f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b\",\"lessThan\":\"84781a1f3c5dc6650480be9329e6e8528939eaa0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b\",\"lessThan\":\"96dd0af7597aba2d80cc97e2f66e8b72d30ba125\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b\",\"lessThan\":\"114af803e409a68e52516810ecd24df4d8ce0c68\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b\",\"lessThan\":\"74ec08f7b81c2726578039ca6dea0fec136c38ea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b\",\"lessThan\":\"0cdc6cb242dd8d2731956fdf3390de094482a4b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4922cd26f03c1c71bf7dd6cbdb638e7e36a4a50b\",\"lessThan\":\"a8e04f3f894ccb52cfcd7e60125a9f35da4a616d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/hid/wacom_wac.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.110\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.5\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0cdc6cb242dd8d2731956fdf3390de094482a4b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/114af803e409a68e52516810ecd24df4d8ce0c68\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1bfc0547b81d5861443420d19b5ed2fd533cd17f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/74ec08f7b81c2726578039ca6dea0fec136c38ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/84781a1f3c5dc6650480be9329e6e8528939eaa0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/96dd0af7597aba2d80cc97e2f66e8b72d30ba125\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a8e04f3f894ccb52cfcd7e60125a9f35da4a616d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d2844f3fcd058113acbe0aa110ab13ef28b98d9f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.