GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-43119 (GCVE-0-2026-43119)

Vulnerability from cvelistv5 – Published: 2026-05-06 07:40 – Updated: 2026-07-24 14:33
VLAI
Title
Bluetooth: hci_sync: annotate data-races around hdev->req_status
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: annotate data-races around hdev->req_status __hci_cmd_sync_sk() sets hdev->req_status under hdev->req_lock: hdev->req_status = HCI_REQ_PEND; However, several other functions read or write hdev->req_status without holding any lock: - hci_send_cmd_sync() reads req_status in hci_cmd_work (workqueue) - hci_cmd_sync_complete() reads/writes from HCI event completion - hci_cmd_sync_cancel() / hci_cmd_sync_cancel_sync() read/write - hci_abort_conn() reads in connection abort path Since __hci_cmd_sync_sk() runs on hdev->req_workqueue while hci_send_cmd_sync() runs on hdev->workqueue, these are different workqueues that can execute concurrently on different CPUs. The plain C accesses constitute a data race. Add READ_ONCE()/WRITE_ONCE() annotations on all concurrent accesses to hdev->req_status to prevent potential compiler optimizations that could affect correctness (e.g., load fusing in the wait_event condition or store reordering).
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f80c5dad7b6467b884c445ffea45985793b4b2d0 , < e51042ddc0b20d9bda5eb6dcf85a2668f9c5dae4 (git)
Affected: f80c5dad7b6467b884c445ffea45985793b4b2d0 , < 6e539907c0d11f514c5e0b049b27b04dff48a5b1 (git)
Affected: f80c5dad7b6467b884c445ffea45985793b4b2d0 , < a7a1cdb4a64ca74eb95cc46648fccb8cd3f9af27 (git)
Affected: f80c5dad7b6467b884c445ffea45985793b4b2d0 , < 40734ce8efc34c4a0d0222855798c0dc14b65f2e (git)
Affected: f80c5dad7b6467b884c445ffea45985793b4b2d0 , < b6807cfc195ef99e1ac37b2e1e60df40295daa8c (git)
Affected: 8603d49906b231bbcd9141db7d096fa1041bc379 (git)
Affected: 0e061885bfcd65ef5d09f154f3c3c3491cc7544a (git)
Affected: a3d50fb7ce931f08a2c6194fdc4c9a56c9ed4153 (git)
Affected: 4.19.47 , < 4.20 (semver)
Affected: 5.0.20 , < 5.1 (semver)
Affected: 5.1.6 , < 5.2 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.83 , ≤ 6.12.* (semver)
Unaffected: 6.18.24 , ≤ 6.18.* (semver)
Unaffected: 6.19.14 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_conn.c",
            "net/bluetooth/hci_core.c",
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e51042ddc0b20d9bda5eb6dcf85a2668f9c5dae4",
              "status": "affected",
              "version": "f80c5dad7b6467b884c445ffea45985793b4b2d0",
              "versionType": "git"
            },
            {
              "lessThan": "6e539907c0d11f514c5e0b049b27b04dff48a5b1",
              "status": "affected",
              "version": "f80c5dad7b6467b884c445ffea45985793b4b2d0",
              "versionType": "git"
            },
            {
              "lessThan": "a7a1cdb4a64ca74eb95cc46648fccb8cd3f9af27",
              "status": "affected",
              "version": "f80c5dad7b6467b884c445ffea45985793b4b2d0",
              "versionType": "git"
            },
            {
              "lessThan": "40734ce8efc34c4a0d0222855798c0dc14b65f2e",
              "status": "affected",
              "version": "f80c5dad7b6467b884c445ffea45985793b4b2d0",
              "versionType": "git"
            },
            {
              "lessThan": "b6807cfc195ef99e1ac37b2e1e60df40295daa8c",
              "status": "affected",
              "version": "f80c5dad7b6467b884c445ffea45985793b4b2d0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8603d49906b231bbcd9141db7d096fa1041bc379",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0e061885bfcd65ef5d09f154f3c3c3491cc7544a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a3d50fb7ce931f08a2c6194fdc4c9a56c9ed4153",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.47",
              "versionType": "semver"
            },
            {
              "lessThan": "5.1",
              "status": "affected",
              "version": "5.0.20",
              "versionType": "semver"
            },
            {
              "lessThan": "5.2",
              "status": "affected",
              "version": "5.1.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_conn.c",
            "net/bluetooth/hci_core.c",
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.47",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.0.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.1.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status\n\n__hci_cmd_sync_sk() sets hdev-\u003ereq_status under hdev-\u003ereq_lock:\n\n    hdev-\u003ereq_status = HCI_REQ_PEND;\n\nHowever, several other functions read or write hdev-\u003ereq_status without\nholding any lock:\n\n  - hci_send_cmd_sync() reads req_status in hci_cmd_work (workqueue)\n  - hci_cmd_sync_complete() reads/writes from HCI event completion\n  - hci_cmd_sync_cancel() / hci_cmd_sync_cancel_sync() read/write\n  - hci_abort_conn() reads in connection abort path\n\nSince __hci_cmd_sync_sk() runs on hdev-\u003ereq_workqueue while\nhci_send_cmd_sync() runs on hdev-\u003eworkqueue, these are different\nworkqueues that can execute concurrently on different CPUs. The plain\nC accesses constitute a data race.\n\nAdd READ_ONCE()/WRITE_ONCE() annotations on all concurrent accesses\nto hdev-\u003ereq_status to prevent potential compiler optimizations that\ncould affect correctness (e.g., load fusing in the wait_event\ncondition or store reordering)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T14:33:34.175Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e51042ddc0b20d9bda5eb6dcf85a2668f9c5dae4"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e539907c0d11f514c5e0b049b27b04dff48a5b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7a1cdb4a64ca74eb95cc46648fccb8cd3f9af27"
        },
        {
          "url": "https://git.kernel.org/stable/c/40734ce8efc34c4a0d0222855798c0dc14b65f2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6807cfc195ef99e1ac37b2e1e60df40295daa8c"
        }
      ],
      "title": "Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43119",
    "datePublished": "2026-05-06T07:40:43.257Z",
    "dateReserved": "2026-05-01T14:12:55.987Z",
    "dateUpdated": "2026-07-24T14:33:34.175Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43119",
      "date": "2026-09-16",
      "epss": "0.00114",
      "percentile": "0.01665"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-10T14:46:27.000Z",
      "cve": "CVE-2026-43119",
      "id": "msrc_CVE-2026-43119",
      "initial_release_date": "2026-05-07T01:09:16.000Z",
      "product_status:known_affected": "8",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-43119.json",
      "version": "11"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43119\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T10:16:25.773\",\"lastModified\":\"2026-07-24T15:17:19.827\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status\\n\\n__hci_cmd_sync_sk() sets hdev-\u003ereq_status under hdev-\u003ereq_lock:\\n\\n    hdev-\u003ereq_status = HCI_REQ_PEND;\\n\\nHowever, several other functions read or write hdev-\u003ereq_status without\\nholding any lock:\\n\\n  - hci_send_cmd_sync() reads req_status in hci_cmd_work (workqueue)\\n  - hci_cmd_sync_complete() reads/writes from HCI event completion\\n  - hci_cmd_sync_cancel() / hci_cmd_sync_cancel_sync() read/write\\n  - hci_abort_conn() reads in connection abort path\\n\\nSince __hci_cmd_sync_sk() runs on hdev-\u003ereq_workqueue while\\nhci_send_cmd_sync() runs on hdev-\u003eworkqueue, these are different\\nworkqueues that can execute concurrently on different CPUs. The plain\\nC accesses constitute a data race.\\n\\nAdd READ_ONCE()/WRITE_ONCE() annotations on all concurrent accesses\\nto hdev-\u003ereq_status to prevent potential compiler optimizations that\\ncould affect correctness (e.g., load fusing in the wait_event\\ncondition or store reordering).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/hci_conn.c\",\"net/bluetooth/hci_core.c\",\"net/bluetooth/hci_sync.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f80c5dad7b6467b884c445ffea45985793b4b2d0\",\"lessThan\":\"e51042ddc0b20d9bda5eb6dcf85a2668f9c5dae4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f80c5dad7b6467b884c445ffea45985793b4b2d0\",\"lessThan\":\"6e539907c0d11f514c5e0b049b27b04dff48a5b1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f80c5dad7b6467b884c445ffea45985793b4b2d0\",\"lessThan\":\"a7a1cdb4a64ca74eb95cc46648fccb8cd3f9af27\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f80c5dad7b6467b884c445ffea45985793b4b2d0\",\"lessThan\":\"40734ce8efc34c4a0d0222855798c0dc14b65f2e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f80c5dad7b6467b884c445ffea45985793b4b2d0\",\"lessThan\":\"b6807cfc195ef99e1ac37b2e1e60df40295daa8c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8603d49906b231bbcd9141db7d096fa1041bc379\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0e061885bfcd65ef5d09f154f3c3c3491cc7544a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3d50fb7ce931f08a2c6194fdc4c9a56c9ed4153\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.19.47\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.0.20\",\"lessThan\":\"5.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.1.6\",\"lessThan\":\"5.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/hci_conn.c\",\"net/bluetooth/hci_core.c\",\"net/bluetooth/hci_sync.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.83\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.24\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.14\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.2\",\"versionEndExcluding\":\"6.12.83\",\"matchCriteriaId\":\"A02C7C65-4552-4547-B8B4-46A1AD0890F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.24\",\"matchCriteriaId\":\"8126B8B8-6D0B-4443-86C1-672AEE893555\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.14\",\"matchCriteriaId\":\"D6A8A074-BBF4-4803-ABED-519A839435BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/40734ce8efc34c4a0d0222855798c0dc14b65f2e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6e539907c0d11f514c5e0b049b27b04dff48a5b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7a1cdb4a64ca74eb95cc46648fccb8cd3f9af27\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b6807cfc195ef99e1ac37b2e1e60df40295daa8c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e51042ddc0b20d9bda5eb6dcf85a2668f9c5dae4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-03T14:57:28+00:00",
      "cve": "CVE-2026-43119",
      "id": "CVE-2026-43119",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43119.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T17:09:32Z",
      "cve": "CVE-2026-43119",
      "id": "CVE-2026-43119",
      "initial_release_date": "2026-05-07T02:18:01Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "578",
      "product_status:known_not_affected": "142",
      "product_status:recommended": "279",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43119",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43119.json",
      "version": "21"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.