CVE-2026-93137 (GCVE-0-2026-93137)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:11 – Updated: 2026-10-19 09:06
VLAI
Title
bpf: Fix use-after-free on mm_struct in bpf_find_vma()
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free on mm_struct in bpf_find_vma() bpf_find_vma() reads task->mm and calls mmap_read_trylock(mm) without holding a reference on the mm. On a foreign task, a concurrent exit_mm() can free the mm_struct between the lockless read and the trylock, resulting in a use-after-free. mm_struct is not SLAB_TYPESAFE_BY_RCU. For the current task, task->mm is stable. For a foreign task, pin the mm under task->alloc_lock and release it with mmput_async(), mirroring commit d8e27d2d22b6 ("bpf: fix mm lifecycle in open-coded task_vma iterator"). Use spin_trylock() instead of get_task_mm() so BPF context does not block on alloc_lock. Reject irqs-disabled contexts and !CONFIG_MMU on the foreign-task path because dropping the mm reference is not safe there. Race: CPU0 (BPF program) CPU1 (exiting task) ============================ ========================== bpf_find_vma(foreign_task): mm = task->mm exit_mm(): task->mm = NULL mmput(mm) -> frees mm_struct mmap_read_trylock(mm) // UAF on mm
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6641 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < db347840d6b6ee9bb9b8e4a985d4b4419f9f3200 (git)
Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < 8e1101fc4118019a69c96ced4aec93164f89cbd5 (git)
Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < c7ad910e987008e125eeff448892e86852173384 (git)
Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < 86d54cf069fc5ae2e111c87933bebf6eb527978e (git)
Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < 2b2a903bee56d312539046d9defa8023eec94760 (git)
Affected: 7c7e3d31e7856a8260a254f8c71db416f7f9f5a1 , < 47b079e2117a2ee52e21f8b72935900c702fc0b5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/task_iter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "db347840d6b6ee9bb9b8e4a985d4b4419f9f3200",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            },
            {
              "lessThan": "8e1101fc4118019a69c96ced4aec93164f89cbd5",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            },
            {
              "lessThan": "c7ad910e987008e125eeff448892e86852173384",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            },
            {
              "lessThan": "86d54cf069fc5ae2e111c87933bebf6eb527978e",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            },
            {
              "lessThan": "2b2a903bee56d312539046d9defa8023eec94760",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            },
            {
              "lessThan": "47b079e2117a2ee52e21f8b72935900c702fc0b5",
              "status": "affected",
              "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/task_iter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix use-after-free on mm_struct in bpf_find_vma()\n\nbpf_find_vma() reads task-\u003emm and calls mmap_read_trylock(mm) without\nholding a reference on the mm. On a foreign task, a concurrent exit_mm()\ncan free the mm_struct between the lockless read and the trylock,\nresulting in a use-after-free. mm_struct is not SLAB_TYPESAFE_BY_RCU.\n\nFor the current task, task-\u003emm is stable. For a foreign task, pin the mm\nunder task-\u003ealloc_lock and release it with mmput_async(), mirroring commit\nd8e27d2d22b6 (\"bpf: fix mm lifecycle in open-coded task_vma iterator\").\nUse spin_trylock() instead of get_task_mm() so BPF context does not block\non alloc_lock. Reject irqs-disabled contexts and !CONFIG_MMU on the\nforeign-task path because dropping the mm reference is not safe there.\n\nRace:\n\n  CPU0 (BPF program)                  CPU1 (exiting task)\n  ============================        ==========================\n  bpf_find_vma(foreign_task):\n    mm = task-\u003emm\n                                      exit_mm():\n                                        task-\u003emm = NULL\n                                        mmput(mm) -\u003e frees mm_struct\n    mmap_read_trylock(mm)\n        // UAF on mm"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - bpf_find_vma() is invoked only from a program loaded via bpf(BPF_PROG_LOAD): BPF_PROG_TYPE_SYSCALL (syscall_prog_func_proto) or tracing/raw_tp (bpf_tracing_func_proto), both reaching bpf_base_func_proto() for BPF_FUNC_find_vma. The stale mm comes from bpf_task_from_pid() or a tracing task argument, not from a remote protocol field.\nAC:L - The race is inside bpf_find_vma() between the lockless task-\u003emm load and mmap_read_trylock(mm). The attacker forks a child, looks it up with bpf_task_from_pid(), and hammers BPF_PROG_RUN (or an attached raw_tp) while that child exits so exit_mm()\u2192mmput() frees the mm; they control both sides.\nPR:L - bpf_base_func_proto() returns bpf_find_vma_proto only after bpf_token_capable(CAP_PERFMON); bpf_prog_load() also needs CAP_BPF, and RAW_TRACEPOINT/TRACING fail is_perfmon_prog_type() without CAP_PERFMON. bpf_token_capable() uses ns_capable() on a delegated token\u0027s userns, so this is not init-namespace root.\nUI:N - The attacker loads the program with BPF_PROG_LOAD, runs it via BPF_PROG_RUN or their own attached probe, and exits their own child so exit_mm() races bpf_find_vma(); no other user must mount a filesystem or open a file.\nS:U - mmap_read_trylock() and find_vma() operate on the host kernel mm_struct that bpf_find_vma() cached from task-\u003emm. That is in-kernel memory corruption in the same authority as the bpf() caller, not a KVM/Xen guest-to-host or IOMMU escape.\nC:H - After exit_mm() mmput() frees the mm_struct (mm_cachep is not SLAB_TYPESAFE_BY_RCU), bpf_find_vma() still calls find_vma(mm, start) and hands the resulting vm_area_struct to the BPF callback, so the program can read reallocated kernel VMA/mm memory.\nI:H - The stale mm is used by mmap_read_trylock() (down_read_trylock on mm-\u003emmap_lock) and bpf_mmap_unlock_mm(); those write a freed mm_struct, and find_vma() may walk a reallocated maple tree, which is UAF corruption exploitable for an arbitrary kernel write.\nA:H - down_read_trylock on a freed mm-\u003emmap_lock or find_vma() walking a freed mm-\u003emm_mt oopses or panics the kernel, and the attacker can repeat bpf_find_vma() against children they exit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:06:10.069Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/db347840d6b6ee9bb9b8e4a985d4b4419f9f3200"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e1101fc4118019a69c96ced4aec93164f89cbd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7ad910e987008e125eeff448892e86852173384"
        },
        {
          "url": "https://git.kernel.org/stable/c/86d54cf069fc5ae2e111c87933bebf6eb527978e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b2a903bee56d312539046d9defa8023eec94760"
        },
        {
          "url": "https://git.kernel.org/stable/c/47b079e2117a2ee52e21f8b72935900c702fc0b5"
        }
      ],
      "title": "bpf: Fix use-after-free on mm_struct in bpf_find_vma()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93137",
    "datePublished": "2026-09-17T16:11:38.135Z",
    "dateReserved": "2026-09-17T16:02:15.088Z",
    "dateUpdated": "2026-10-19T09:06:10.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93137",
      "date": "2026-11-13",
      "epss": "0.0016",
      "percentile": "0.05172"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-21T18:34:28.000Z",
      "cve": "CVE-2026-93137",
      "id": "msrc_CVE-2026-93137",
      "initial_release_date": "2026-09-19T01:18:27.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: Fix use-after-free on mm_struct in bpf_find_vma()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-93137.json",
      "version": "6"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/task_iter.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "db347840d6b6ee9bb9b8e4a985d4b4419f9f3200",
                    "status": "affected",
                    "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8e1101fc4118019a69c96ced4aec93164f89cbd5",
                    "status": "affected",
                    "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c7ad910e987008e125eeff448892e86852173384",
                    "status": "affected",
                    "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "86d54cf069fc5ae2e111c87933bebf6eb527978e",
                    "status": "affected",
                    "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2b2a903bee56d312539046d9defa8023eec94760",
                    "status": "affected",
                    "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "47b079e2117a2ee52e21f8b72935900c702fc0b5",
                    "status": "affected",
                    "version": "7c7e3d31e7856a8260a254f8c71db416f7f9f5a1",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/task_iter.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.17"
                  },
                  {
                    "lessThan": "5.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix use-after-free on mm_struct in bpf_find_vma()\n\nbpf_find_vma() reads task-\u003emm and calls mmap_read_trylock(mm) without\nholding a reference on the mm. On a foreign task, a concurrent exit_mm()\ncan free the mm_struct between the lockless read and the trylock,\nresulting in a use-after-free. mm_struct is not SLAB_TYPESAFE_BY_RCU.\n\nFor the current task, task-\u003emm is stable. For a foreign task, pin the mm\nunder task-\u003ealloc_lock and release it with mmput_async(), mirroring commit\nd8e27d2d22b6 (\"bpf: fix mm lifecycle in open-coded task_vma iterator\").\nUse spin_trylock() instead of get_task_mm() so BPF context does not block\non alloc_lock. Reject irqs-disabled contexts and !CONFIG_MMU on the\nforeign-task path because dropping the mm reference is not safe there.\n\nRace:\n\n  CPU0 (BPF program)                  CPU1 (exiting task)\n  ============================        ==========================\n  bpf_find_vma(foreign_task):\n    mm = task-\u003emm\n                                      exit_mm():\n                                        task-\u003emm = NULL\n                                        mmput(mm) -\u003e frees mm_struct\n    mmap_read_trylock(mm)\n        // UAF on mm"
          }
        ],
        "id": "CVE-2026-93137",
        "lastModified": "2026-10-19T10:17:03.707",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:18:08.600",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2b2a903bee56d312539046d9defa8023eec94760"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/47b079e2117a2ee52e21f8b72935900c702fc0b5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/86d54cf069fc5ae2e111c87933bebf6eb527978e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8e1101fc4118019a69c96ced4aec93164f89cbd5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c7ad910e987008e125eeff448892e86852173384"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/db347840d6b6ee9bb9b8e4a985d4b4419f9f3200"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-06T01:59:09+00:00",
      "cve": "CVE-2026-93137",
      "id": "CVE-2026-93137",
      "initial_release_date": "2026-09-17T00:00:00+00:00",
      "product_status:known_affected": "112",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Fix use-after-free on mm_struct in bpf_find_vma()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93137.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-20T00:26:02Z",
      "cve": "CVE-2026-93137",
      "id": "CVE-2026-93137",
      "initial_release_date": "2026-09-18T00:11:43Z",
      "product_status:known_affected": "163",
      "product_status:known_not_affected": "185",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-93137",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-93137.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.