CVE-2026-99136 (GCVE-0-2026-99136)

Vulnerability from cvelistv5 – Published: 2026-10-28 10:34 – Updated: 2026-10-31 12:43
VLAI
Title
dm-crypt: fix a tiny race condition in crypt_dec_pending
Summary
In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in crypt_dec_pending crypt_dec_pending reads io->error before calling atomic_dec_and_test. Another context, for example crypt_endio called from an interrupt, may set io->error and drop its reference between the read and the decrement. crypt_dec_pending then drops the last reference and completes the bio with the stale status - so a read that failed and was never decrypted, or a write that failed, is reported as successful. The read was placed before the decrement by commit b35f8caa0890 ("dm crypt: wait for endio to complete before destruction"), because that commit freed dm_crypt_io before calling bio_endio. This is no longer the case, dm_crypt_io lives in the per-bio data now. Read io->error after atomic_dec_and_test instead. atomic_dec_and_test is fully ordered, so no additional barrier is needed.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7018 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b35f8caa0890169000fec22902290d9a15274cbd , < 445a6883f46d3ab1ff545199a8cc1d5834936d3f (git)
Affected: b35f8caa0890169000fec22902290d9a15274cbd , < 6f82e86471c92fd874f2630c9a6af887f4ed1a77 (git)
Affected: b35f8caa0890169000fec22902290d9a15274cbd , < 6ac8546df1f8a2b1ca7f6d67c269057a99fbbf8c (git)
Affected: b35f8caa0890169000fec22902290d9a15274cbd , < 056bf8322e39a48026df352d6227ec03dd8cd032 (git)
Affected: b35f8caa0890169000fec22902290d9a15274cbd , < d9d7069bb79139271b54dc477f07e242c445de6b (git)
Affected: b35f8caa0890169000fec22902290d9a15274cbd , < ac5d887ab93592fc5e3605fe30c1d8d232d609b3 (git)
Affected: b35f8caa0890169000fec22902290d9a15274cbd , < 4f16bb982b27b9f5a15301f622c318001fe521f8 (git)
Affected: b35f8caa0890169000fec22902290d9a15274cbd , < 148845aa1921d95ef5dc851c76e6a284f6657df6 (git)
Affected: 9c8f3fcd3ffd3283cc0971c8919058356f20a963 (git)
Affected: 2.6.28.9 , < 2.6.29 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.29
Unaffected: 0 , < 2.6.29 (semver)
Unaffected: 5.10.273 , ≤ 5.10.* (semver)
Unaffected: 5.15.224 , ≤ 5.15.* (semver)
Unaffected: 6.1.191 , ≤ 6.1.* (semver)
Unaffected: 6.6.161 , ≤ 6.6.* (semver)
Unaffected: 6.12.115 , ≤ 6.12.* (semver)
Unaffected: 6.18.59 , ≤ 6.18.* (semver)
Unaffected: 7.2.13 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-crypt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "445a6883f46d3ab1ff545199a8cc1d5834936d3f",
              "status": "affected",
              "version": "b35f8caa0890169000fec22902290d9a15274cbd",
              "versionType": "git"
            },
            {
              "lessThan": "6f82e86471c92fd874f2630c9a6af887f4ed1a77",
              "status": "affected",
              "version": "b35f8caa0890169000fec22902290d9a15274cbd",
              "versionType": "git"
            },
            {
              "lessThan": "6ac8546df1f8a2b1ca7f6d67c269057a99fbbf8c",
              "status": "affected",
              "version": "b35f8caa0890169000fec22902290d9a15274cbd",
              "versionType": "git"
            },
            {
              "lessThan": "056bf8322e39a48026df352d6227ec03dd8cd032",
              "status": "affected",
              "version": "b35f8caa0890169000fec22902290d9a15274cbd",
              "versionType": "git"
            },
            {
              "lessThan": "d9d7069bb79139271b54dc477f07e242c445de6b",
              "status": "affected",
              "version": "b35f8caa0890169000fec22902290d9a15274cbd",
              "versionType": "git"
            },
            {
              "lessThan": "ac5d887ab93592fc5e3605fe30c1d8d232d609b3",
              "status": "affected",
              "version": "b35f8caa0890169000fec22902290d9a15274cbd",
              "versionType": "git"
            },
            {
              "lessThan": "4f16bb982b27b9f5a15301f622c318001fe521f8",
              "status": "affected",
              "version": "b35f8caa0890169000fec22902290d9a15274cbd",
              "versionType": "git"
            },
            {
              "lessThan": "148845aa1921d95ef5dc851c76e6a284f6657df6",
              "status": "affected",
              "version": "b35f8caa0890169000fec22902290d9a15274cbd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9c8f3fcd3ffd3283cc0971c8919058356f20a963",
              "versionType": "git"
            },
            {
              "lessThan": "2.6.29",
              "status": "affected",
              "version": "2.6.28.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-crypt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.273",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.224",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.161",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.115",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.59",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.13",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.28.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-crypt: fix a tiny race condition in crypt_dec_pending\n\ncrypt_dec_pending reads io-\u003eerror before calling atomic_dec_and_test.\nAnother context, for example crypt_endio called from an interrupt, may\nset io-\u003eerror and drop its reference between the read and the\ndecrement. crypt_dec_pending then drops the last reference and completes\nthe bio with the stale status - so a read that failed and was never\ndecrypted, or a write that failed, is reported as successful.\n\nThe read was placed before the decrement by commit b35f8caa0890 (\"dm\ncrypt: wait for endio to complete before destruction\"), because that\ncommit freed dm_crypt_io before calling bio_endio. This is no longer the\ncase, dm_crypt_io lives in the per-bio data now.\n\nRead io-\u003eerror after atomic_dec_and_test instead. atomic_dec_and_test is\nfully ordered, so no additional barrier is needed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A local read(2) or write(2) on a file on an existing dm-crypt volume follows vfs_read/vfs_write through the filesystem, submit_bio(), dm_submit_bio(), crypt_map(), and patched crypt_dec_pending(); no network message supplies the failed bio or stale status.\nAC:H - Exploitation needs a lower read/write or crypto operation to fail and its crypt_endio() error store/decrement to land between crypt_dec_pending()\u0027s error load and atomic decrement. The caller can repeat I/O but cannot ordinarily induce the device failure or interrupt timing, so it does not control both sides.\nPR:L - An unprivileged user with ordinary read or write permission on a file backed by the mapped volume reaches crypt_map(); vfs_read/vfs_write gate this with the open mode and security_file_permission(), not a capability. CAP_SYS_ADMIN in ctl_ioctl() gates creating the dm table, not I/O on an existing mapping.\nUI:N - The attacker issues the read/write and can evict their readable file pages or repeat I/O themselves; no second user must open a file, mount attacker-supplied media, or approve an action.\nS:U - crypt_dec_pending() misreports completion of a host-kernel bio to the same host filesystem/block stack; it crosses no VM, IOMMU, or separate security-authority boundary.\nC:H - For buffered reads, stale success makes ext4 mpage_end_io()-\u003e__read_end_io() mark a fresh filemap_alloc_folio(GFP_HIGHUSER_MOVABLE) folio uptodate although the failed read never filled or decrypted it; filemap_read() then copy_folio_to_iter() exposes prior physical-page contents.\nI:H - For writes, stale success makes ext4_end_bio() and JBD2 journal_end_buffer_io_sync() skip their error paths and accept failed data, metadata, or commit-record bios as durable. This can silently lose updates and leave the encrypted filesystem persistently inconsistent.\nA:H - Because the false status prevents ext4/JBD2 from recording the I/O error or aborting the journal, continued operation after failed metadata or commit writes can leave the volume unusable; false-success metadata reads can likewise install random buffers as valid."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T12:43:39.281Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/445a6883f46d3ab1ff545199a8cc1d5834936d3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f82e86471c92fd874f2630c9a6af887f4ed1a77"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ac8546df1f8a2b1ca7f6d67c269057a99fbbf8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/056bf8322e39a48026df352d6227ec03dd8cd032"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9d7069bb79139271b54dc477f07e242c445de6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac5d887ab93592fc5e3605fe30c1d8d232d609b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f16bb982b27b9f5a15301f622c318001fe521f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/148845aa1921d95ef5dc851c76e6a284f6657df6"
        }
      ],
      "title": "dm-crypt: fix a tiny race condition in crypt_dec_pending",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99136",
    "datePublished": "2026-10-28T10:34:48.558Z",
    "dateReserved": "2026-09-25T10:25:14.395Z",
    "dateUpdated": "2026-10-31T12:43:39.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-99136",
      "date": "2026-11-01",
      "epss": "0.00122",
      "percentile": "0.01971"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-29T01:05:10.000Z",
      "cve": "CVE-2026-99136",
      "id": "msrc_CVE-2026-99136",
      "initial_release_date": "2026-10-29T01:05:10.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "dm-crypt: fix a tiny race condition in crypt_dec_pending",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-99136.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/dm-crypt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "445a6883f46d3ab1ff545199a8cc1d5834936d3f",
                    "status": "affected",
                    "version": "b35f8caa0890169000fec22902290d9a15274cbd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6f82e86471c92fd874f2630c9a6af887f4ed1a77",
                    "status": "affected",
                    "version": "b35f8caa0890169000fec22902290d9a15274cbd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6ac8546df1f8a2b1ca7f6d67c269057a99fbbf8c",
                    "status": "affected",
                    "version": "b35f8caa0890169000fec22902290d9a15274cbd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "056bf8322e39a48026df352d6227ec03dd8cd032",
                    "status": "affected",
                    "version": "b35f8caa0890169000fec22902290d9a15274cbd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d9d7069bb79139271b54dc477f07e242c445de6b",
                    "status": "affected",
                    "version": "b35f8caa0890169000fec22902290d9a15274cbd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ac5d887ab93592fc5e3605fe30c1d8d232d609b3",
                    "status": "affected",
                    "version": "b35f8caa0890169000fec22902290d9a15274cbd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4f16bb982b27b9f5a15301f622c318001fe521f8",
                    "status": "affected",
                    "version": "b35f8caa0890169000fec22902290d9a15274cbd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "148845aa1921d95ef5dc851c76e6a284f6657df6",
                    "status": "affected",
                    "version": "b35f8caa0890169000fec22902290d9a15274cbd",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "9c8f3fcd3ffd3283cc0971c8919058356f20a963",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2.6.29",
                    "status": "affected",
                    "version": "2.6.28.9",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/dm-crypt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.29"
                  },
                  {
                    "lessThan": "2.6.29",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.273",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.224",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.191",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.161",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.115",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.59",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-crypt: fix a tiny race condition in crypt_dec_pending\n\ncrypt_dec_pending reads io-\u003eerror before calling atomic_dec_and_test.\nAnother context, for example crypt_endio called from an interrupt, may\nset io-\u003eerror and drop its reference between the read and the\ndecrement. crypt_dec_pending then drops the last reference and completes\nthe bio with the stale status - so a read that failed and was never\ndecrypted, or a write that failed, is reported as successful.\n\nThe read was placed before the decrement by commit b35f8caa0890 (\"dm\ncrypt: wait for endio to complete before destruction\"), because that\ncommit freed dm_crypt_io before calling bio_endio. This is no longer the\ncase, dm_crypt_io lives in the per-bio data now.\n\nRead io-\u003eerror after atomic_dec_and_test instead. atomic_dec_and_test is\nfully ordered, so no additional barrier is needed."
          }
        ],
        "id": "CVE-2026-99136",
        "lastModified": "2026-10-31T13:17:56.900",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-28T11:17:33.513",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/056bf8322e39a48026df352d6227ec03dd8cd032"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/148845aa1921d95ef5dc851c76e6a284f6657df6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/445a6883f46d3ab1ff545199a8cc1d5834936d3f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4f16bb982b27b9f5a15301f622c318001fe521f8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6ac8546df1f8a2b1ca7f6d67c269057a99fbbf8c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6f82e86471c92fd874f2630c9a6af887f4ed1a77"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ac5d887ab93592fc5e3605fe30c1d8d232d609b3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d9d7069bb79139271b54dc477f07e242c445de6b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-10-31T15:50:44+00:00",
      "cve": "CVE-2026-99136",
      "id": "CVE-2026-99136",
      "initial_release_date": "2026-10-28T10:34:48.558000+00:00",
      "product_status:known_affected": "279",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: kernel: Data corruption via race condition in dm-crypt",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-99136.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.