CVE-2026-90003 (GCVE-0-2026-90003)
Vulnerability from cvelistv5 – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
EPSS
VEX
Title
futex: Prevent rcuwait use-after-free during requeue PI
Summary
In the Linux kernel, the following vulnerability has been resolved:
futex: Prevent rcuwait use-after-free during requeue PI
On PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report
(slab-out-of-bounds) in futex_requeue_pi_complete() invocation of
rcuwait_wake_up().
The futex_q used by futex_wait_requeue_pi() is allocated on the waiter's
stack. An early wakeup can race with a PI requeue as follows:
waiter requeue task
------ ------------
futex_wait_requeue_pi()
futex_do_wait()
schedule()
futex_requeue
futex_proxy_trylock_atomic()
futex_requeue_pi_prepare()
Q_REQUEUE_PI_NONE -> Q_REQUEUE_PI_IN_PROGRESS
* timeout/ signal wakes waiter *
futex_requeue_pi_wakeup_sync()
Q_REQUEUE_PI_IN_PROGRESS -> Q_REQUEUE_PI_WAIT
requeue_pi_wake_futex
futex_requeue_pi_complete()
cmpxchg Q_REQUEUE_PI_WAIT -> Q_REQUEUE_PI_LOCKED
rcuwait_wait_event()
if (atomic_read(&q->requeue_state) != Q_REQUEUE_PI_WAIT)
break /* no schedule() */
/* q.pi_state->owner == current */
futex_private_hash_put()
/* return from syscall */
rcuwait_wake_up(&q->requeue_wait)
/* q is gone */
futex_requeue_pi_complete() publishes Q_REQUEUE_PI_LOCKED before
calling rcuwait_wake_up(). The waiter observes this state in
rcuwait_wait_event() before invoking schedule() in rcuwait_wait_event().
Here, the waiter is free leave the syscall before requeue task can
complete the wake.
To address this race skip rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED
case.
This state is only published by requeue_pi_wake_futex(), which saves
q->task before futex_requeue_pi_complete() and wakes the waiter via
wake_up_state().
This wake is intended to wake the waiter from its futex_do_wait() sleep.
If the waiter is still sleeping there, it can not get into the
Q_REQUEUE_PI_WAIT state (and require this removed wake).
Should the waiter be woken up from futex_do_wait() by other means (as in
this example) and sleep in futex_requeue_pi_wakeup_sync() then the
wake_up_state() from requeue_pi_wake_futex() will wake it, too.
Should the waiter task terminate before wake_up_state() had a chance to
wake the task then the task pointer does not become invalid because the
futex_hash_bucket::lock is held and the task pointer is RCU protected.
[bigeasy: Updated comment and commit message]
Severity
7.8 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
07d91ef510fb16a2e0ca7453222105835b7ba3b8 , < 220ee9e04ca3b7f014c000264aa6c884f036c86e
(git)
Affected: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 , < 81aadbd09bf1dcd3238212f336ba699503557ae8 (git) Affected: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 , < 244f301759fd34b1dd0b4192ce44f8ef224e027d (git) Affected: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 , < 7d1559126d86be6e4f6a85663dfbfe85caa47e37 (git) Affected: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 , < e4a4ccfa470f910b747b3ee8d18670ed8ac8a236 (git) Affected: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 , < a3b8d46fe401cba3a5c46dea610e6eb3dc15370e (git) |
guessed | |
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/futex/requeue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "220ee9e04ca3b7f014c000264aa6c884f036c86e",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "81aadbd09bf1dcd3238212f336ba699503557ae8",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "244f301759fd34b1dd0b4192ce44f8ef224e027d",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "7d1559126d86be6e4f6a85663dfbfe85caa47e37",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "e4a4ccfa470f910b747b3ee8d18670ed8ac8a236",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "a3b8d46fe401cba3a5c46dea610e6eb3dc15370e",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/futex/requeue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Prevent rcuwait use-after-free during requeue PI\n\nOn PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report\n(slab-out-of-bounds) in futex_requeue_pi_complete() invocation of\nrcuwait_wake_up().\n\nThe futex_q used by futex_wait_requeue_pi() is allocated on the waiter\u0027s\nstack. An early wakeup can race with a PI requeue as follows:\n\n waiter requeue task\n ------ ------------\nfutex_wait_requeue_pi()\n futex_do_wait()\n schedule()\n futex_requeue\n futex_proxy_trylock_atomic()\n futex_requeue_pi_prepare()\n Q_REQUEUE_PI_NONE -\u003e Q_REQUEUE_PI_IN_PROGRESS\n* timeout/ signal wakes waiter *\n futex_requeue_pi_wakeup_sync()\n Q_REQUEUE_PI_IN_PROGRESS -\u003e Q_REQUEUE_PI_WAIT\n requeue_pi_wake_futex\n futex_requeue_pi_complete()\n cmpxchg Q_REQUEUE_PI_WAIT -\u003e Q_REQUEUE_PI_LOCKED\n rcuwait_wait_event()\n if (atomic_read(\u0026q-\u003erequeue_state) != Q_REQUEUE_PI_WAIT)\n break /* no schedule() */\n\n /* q.pi_state-\u003eowner == current */\n futex_private_hash_put()\n /* return from syscall */\n rcuwait_wake_up(\u0026q-\u003erequeue_wait)\n /* q is gone */\n\nfutex_requeue_pi_complete() publishes Q_REQUEUE_PI_LOCKED before\ncalling rcuwait_wake_up(). The waiter observes this state in\nrcuwait_wait_event() before invoking schedule() in rcuwait_wait_event().\nHere, the waiter is free leave the syscall before requeue task can\ncomplete the wake.\n\nTo address this race skip rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED\ncase.\nThis state is only published by requeue_pi_wake_futex(), which saves\nq-\u003etask before futex_requeue_pi_complete() and wakes the waiter via\nwake_up_state().\n\nThis wake is intended to wake the waiter from its futex_do_wait() sleep.\nIf the waiter is still sleeping there, it can not get into the\nQ_REQUEUE_PI_WAIT state (and require this removed wake).\nShould the waiter be woken up from futex_do_wait() by other means (as in\nthis example) and sleep in futex_requeue_pi_wakeup_sync() then the\nwake_up_state() from requeue_pi_wake_futex() will wake it, too.\nShould the waiter task terminate before wake_up_state() had a chance to\nwake the task then the task pointer does not become invalid because the\nfutex_hash_bucket::lock is held and the task pointer is RCU protected.\n\n[bigeasy: Updated comment and commit message]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through the local futex(2) syscalls FUTEX_WAIT_REQUEUE_PI and FUTEX_CMP_REQUEUE_PI into kernel/futex/requeue.c; there is no network, Bluetooth, or physical-device path.\nAC:L - The attacker controls both sides of the race: a waiter thread using FUTEX_WAIT_REQUEUE_PI with an attacker-chosen timeout or signal, and a concurrent FUTEX_CMP_REQUEUE_PI from another thread, and can retry with CPU pinning until the waiter returns before rcuwait_wake_up() on PREEMPT_RT.\nPR:L - Any unprivileged local user can invoke futex() with FUTEX_WAIT_REQUEUE_PI and FUTEX_CMP_REQUEUE_PI; do_futex() and futex_requeue() perform no capability or credential checks, CONFIG_FUTEX_PI is default-y, and the path is reachable from containers without elevated privileges.\nUI:N - The attacker\u0027s own threads perform the wait, timeout or signal, and PI requeue; no victim action such as mounting a filesystem or opening a file is required.\nS:U - The use-after-free corrupts kernel memory (the waiter\u0027s stack-allocated futex_q and a type-confused task_struct) within the same kernel security authority; this is a standard local privilege-escalation issue, not a VM, IOMMU, or hypervisor escape.\nC:H - This is a use-after-free of the waiter\u0027s stack-allocated futex_q.requeue_wait; rcuwait_wake_up() reads a stale, attacker-refilled task_struct pointer and dereferences it in try_to_wake_up(), enabling arbitrary kernel-memory disclosure.\nI:H - The stale futex_q lives on the attacker\u0027s own kernel stack, which a following syscall can refill with controlled bytes, so rcuwait_wake_up() passes an attacker-chosen pointer into try_to_wake_up(), which writes task state and makes indirect scheduler calls, enabling privilege escalation.\nA:H - In the unexploited case, rcuwait_wake_up() dereferences a wild pointer from reused stack memory and causes a kernel oops or panic; any use-after-free of this kind is a High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:41:20.519Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/220ee9e04ca3b7f014c000264aa6c884f036c86e"
},
{
"url": "https://git.kernel.org/stable/c/81aadbd09bf1dcd3238212f336ba699503557ae8"
},
{
"url": "https://git.kernel.org/stable/c/244f301759fd34b1dd0b4192ce44f8ef224e027d"
},
{
"url": "https://git.kernel.org/stable/c/7d1559126d86be6e4f6a85663dfbfe85caa47e37"
},
{
"url": "https://git.kernel.org/stable/c/e4a4ccfa470f910b747b3ee8d18670ed8ac8a236"
},
{
"url": "https://git.kernel.org/stable/c/a3b8d46fe401cba3a5c46dea610e6eb3dc15370e"
}
],
"title": "futex: Prevent rcuwait use-after-free during requeue PI",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90003",
"datePublished": "2026-09-16T10:33:13.420Z",
"dateReserved": "2026-09-11T19:38:34.780Z",
"dateUpdated": "2026-09-16T14:41:20.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-90003\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-16T11:17:12.810\",\"lastModified\":\"2026-09-16T15:18:24.143\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfutex: Prevent rcuwait use-after-free during requeue PI\\n\\nOn PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report\\n(slab-out-of-bounds) in futex_requeue_pi_complete() invocation of\\nrcuwait_wake_up().\\n\\nThe futex_q used by futex_wait_requeue_pi() is allocated on the waiter\u0027s\\nstack. An early wakeup can race with a PI requeue as follows:\\n\\n waiter requeue task\\n ------ ------------\\nfutex_wait_requeue_pi()\\n futex_do_wait()\\n schedule()\\n futex_requeue\\n futex_proxy_trylock_atomic()\\n futex_requeue_pi_prepare()\\n Q_REQUEUE_PI_NONE -\u003e Q_REQUEUE_PI_IN_PROGRESS\\n* timeout/ signal wakes waiter *\\n futex_requeue_pi_wakeup_sync()\\n Q_REQUEUE_PI_IN_PROGRESS -\u003e Q_REQUEUE_PI_WAIT\\n requeue_pi_wake_futex\\n futex_requeue_pi_complete()\\n cmpxchg Q_REQUEUE_PI_WAIT -\u003e Q_REQUEUE_PI_LOCKED\\n rcuwait_wait_event()\\n if (atomic_read(\u0026q-\u003erequeue_state) != Q_REQUEUE_PI_WAIT)\\n break /* no schedule() */\\n\\n /* q.pi_state-\u003eowner == current */\\n futex_private_hash_put()\\n /* return from syscall */\\n rcuwait_wake_up(\u0026q-\u003erequeue_wait)\\n /* q is gone */\\n\\nfutex_requeue_pi_complete() publishes Q_REQUEUE_PI_LOCKED before\\ncalling rcuwait_wake_up(). The waiter observes this state in\\nrcuwait_wait_event() before invoking schedule() in rcuwait_wait_event().\\nHere, the waiter is free leave the syscall before requeue task can\\ncomplete the wake.\\n\\nTo address this race skip rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED\\ncase.\\nThis state is only published by requeue_pi_wake_futex(), which saves\\nq-\u003etask before futex_requeue_pi_complete() and wakes the waiter via\\nwake_up_state().\\n\\nThis wake is intended to wake the waiter from its futex_do_wait() sleep.\\nIf the waiter is still sleeping there, it can not get into the\\nQ_REQUEUE_PI_WAIT state (and require this removed wake).\\nShould the waiter be woken up from futex_do_wait() by other means (as in\\nthis example) and sleep in futex_requeue_pi_wakeup_sync() then the\\nwake_up_state() from requeue_pi_wake_futex() will wake it, too.\\nShould the waiter task terminate before wake_up_state() had a chance to\\nwake the task then the task pointer does not become invalid because the\\nfutex_hash_bucket::lock is held and the task pointer is RCU protected.\\n\\n[bigeasy: Updated comment and commit message]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/futex/requeue.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"07d91ef510fb16a2e0ca7453222105835b7ba3b8\",\"lessThan\":\"220ee9e04ca3b7f014c000264aa6c884f036c86e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"07d91ef510fb16a2e0ca7453222105835b7ba3b8\",\"lessThan\":\"81aadbd09bf1dcd3238212f336ba699503557ae8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"07d91ef510fb16a2e0ca7453222105835b7ba3b8\",\"lessThan\":\"244f301759fd34b1dd0b4192ce44f8ef224e027d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"07d91ef510fb16a2e0ca7453222105835b7ba3b8\",\"lessThan\":\"7d1559126d86be6e4f6a85663dfbfe85caa47e37\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"07d91ef510fb16a2e0ca7453222105835b7ba3b8\",\"lessThan\":\"e4a4ccfa470f910b747b3ee8d18670ed8ac8a236\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"07d91ef510fb16a2e0ca7453222105835b7ba3b8\",\"lessThan\":\"a3b8d46fe401cba3a5c46dea610e6eb3dc15370e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/futex/requeue.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.110\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.5\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/220ee9e04ca3b7f014c000264aa6c884f036c86e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/244f301759fd34b1dd0b4192ce44f8ef224e027d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7d1559126d86be6e4f6a85663dfbfe85caa47e37\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/81aadbd09bf1dcd3238212f336ba699503557ae8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a3b8d46fe401cba3a5c46dea610e6eb3dc15370e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e4a4ccfa470f910b747b3ee8d18670ed8ac8a236\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…