GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80671 (GCVE-0-2026-80671)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:49 – Updated: 2026-09-14 11:58
VLAI
Title
perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
Summary
In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix register_pid() overflow, strcpy, and BUG_ON register_pid() has several issues when processing untrusted perf.data: 1. Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap to a small value on 32-bit systems when pid is large (e.g. 0x40000000), causing realloc to return a tiny buffer followed by out-of-bounds writes in the initialization loop. 2. Heap buffer overflow: strcpy(task->comm, comm) copies the untrusted comm string into a fixed 20-byte COMM_LEN buffer with no length check. 3. BUG_ON on allocation failure: perf.data is untrusted input, so allocation failures should be handled gracefully rather than killing the process. 4. Realloc of sched->tasks assigned directly back, leaking the old pointer on failure; nr_tasks incremented before the realloc, leaving corrupted state on failure. Cap pid at PID_MAX_LIMIT (4194304, matching the kernel's maximum on 64-bit), replace strcpy with strlcpy, guard against NULL comm, replace BUG_ON with NULL returns using safe realloc patterns, and add NULL checks in callers that dereference the result.
Severity
9.3 (Critical)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ec156764d424dd67283c2cd5e9f6f1b8388364ac , < 344e59fc4f2cba6dc04ce5e2a77388645d4ca834 (git)
Affected: ec156764d424dd67283c2cd5e9f6f1b8388364ac , < 22263d241bad753217d545f8085b7ead52e2873b (git)
Affected: ec156764d424dd67283c2cd5e9f6f1b8388364ac , < 2003918e13f43cf6c5698be3cc9aa3657dd676a8 (git)
Affected: ec156764d424dd67283c2cd5e9f6f1b8388364ac , < 29639f00bfa49da7904ba0a499e0da7a0e5d735e (git)
Affected: ec156764d424dd67283c2cd5e9f6f1b8388364ac , < 261d2b5f4afa0570ca906e553c93811c5abe4590 (git)
Affected: ec156764d424dd67283c2cd5e9f6f1b8388364ac , < 652cea73b7b7b7c622a2be670e44e3c499c6d49f (git)
Affected: ec156764d424dd67283c2cd5e9f6f1b8388364ac , < 5ea1dcc9418c4e06ce29ed5170596f497ba86872 (git)
Affected: ec156764d424dd67283c2cd5e9f6f1b8388364ac , < 5949d339f5ec98752d56dcd4e36f619a59d513a5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.32
Unaffected: 0 , < 2.6.32 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "tools/perf/builtin-sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "344e59fc4f2cba6dc04ce5e2a77388645d4ca834",
              "status": "affected",
              "version": "ec156764d424dd67283c2cd5e9f6f1b8388364ac",
              "versionType": "git"
            },
            {
              "lessThan": "22263d241bad753217d545f8085b7ead52e2873b",
              "status": "affected",
              "version": "ec156764d424dd67283c2cd5e9f6f1b8388364ac",
              "versionType": "git"
            },
            {
              "lessThan": "2003918e13f43cf6c5698be3cc9aa3657dd676a8",
              "status": "affected",
              "version": "ec156764d424dd67283c2cd5e9f6f1b8388364ac",
              "versionType": "git"
            },
            {
              "lessThan": "29639f00bfa49da7904ba0a499e0da7a0e5d735e",
              "status": "affected",
              "version": "ec156764d424dd67283c2cd5e9f6f1b8388364ac",
              "versionType": "git"
            },
            {
              "lessThan": "261d2b5f4afa0570ca906e553c93811c5abe4590",
              "status": "affected",
              "version": "ec156764d424dd67283c2cd5e9f6f1b8388364ac",
              "versionType": "git"
            },
            {
              "lessThan": "652cea73b7b7b7c622a2be670e44e3c499c6d49f",
              "status": "affected",
              "version": "ec156764d424dd67283c2cd5e9f6f1b8388364ac",
              "versionType": "git"
            },
            {
              "lessThan": "5ea1dcc9418c4e06ce29ed5170596f497ba86872",
              "status": "affected",
              "version": "ec156764d424dd67283c2cd5e9f6f1b8388364ac",
              "versionType": "git"
            },
            {
              "lessThan": "5949d339f5ec98752d56dcd4e36f619a59d513a5",
              "status": "affected",
              "version": "ec156764d424dd67283c2cd5e9f6f1b8388364ac",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "tools/perf/builtin-sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.32"
            },
            {
              "lessThan": "2.6.32",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf sched: Fix register_pid() overflow, strcpy, and BUG_ON\n\nregister_pid() has several issues when processing untrusted perf.data:\n\n1. Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap\n   to a small value on 32-bit systems when pid is large (e.g.\n   0x40000000), causing realloc to return a tiny buffer followed by\n   out-of-bounds writes in the initialization loop.\n\n2. Heap buffer overflow: strcpy(task-\u003ecomm, comm) copies the\n   untrusted comm string into a fixed 20-byte COMM_LEN buffer with\n   no length check.\n\n3. BUG_ON on allocation failure: perf.data is untrusted input, so\n   allocation failures should be handled gracefully rather than\n   killing the process.\n\n4. Realloc of sched-\u003etasks assigned directly back, leaking the old\n   pointer on failure; nr_tasks incremented before the realloc,\n   leaving corrupted state on failure.\n\nCap pid at PID_MAX_LIMIT (4194304, matching the kernel\u0027s maximum\non 64-bit), replace strcpy with strlcpy, guard against NULL comm,\nreplace BUG_ON with NULL returns using safe realloc patterns, and\nadd NULL checks in callers that dereference the result."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in userspace perf\u0027s builtin-sched.c reached only when a local user runs perf sched replay or perf sched latency against a crafted perf.data file via perf_session__process_events; it is not triggered by remote network packets, kernel syscalls, or in-kernel sched code.\nAC:L - The attacker fully controls untrusted perf.data sched_switch/sched_wakeup fields (prev_pid, next_pid, prev_comm, next_comm); large PIDs and overlong comm strings deterministically hit the integer-overflow realloc path or strcpy heap overflow without races or victim-specific memory layout.\nPR:N - In the malicious-trace threat model an external party needs no account or privileges on the victim host\u2014they only supply a crafted perf.data file for a developer, support engineer, or CI job to analyze with perf sched replay/latency.\nUI:N - Once a trace is submitted to triage or CI, perf sched replay/latency parses perf.data non-interactively through perf_sched__read_events without further per-event operator actions beyond automated invocation of the perf command on the supplied file.\nS:C - Malicious sched metadata embedded in an externally supplied perf.data crosses from the untrusted reporter/artifact domain into the analyst or CI host security authority when perf parses that file, matching the kernel CNA untrusted-artifact model used for crafted filesystem images.\nC:H - Integer-overflow-driven out-of-bounds writes into the pid_to_task table and strcpy heap overflow past task_desc.comm[20] corrupt adjacent heap objects and can disclose process memory beyond a few bounded bytes.\nI:H - Attacker-controlled overflows corrupt task_desc function pointers and heap metadata (including the atoms pointer), providing controllable userspace memory corruption suitable for arbitrary write and code execution in the perf process.\nA:H - Pre-fix BUG_ON paths abort the perf process on allocation failure, and the heap out-of-bounds writes reliably crash or hang perf during register_pid() while parsing malicious perf.data."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:58:49.345Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/344e59fc4f2cba6dc04ce5e2a77388645d4ca834"
        },
        {
          "url": "https://git.kernel.org/stable/c/22263d241bad753217d545f8085b7ead52e2873b"
        },
        {
          "url": "https://git.kernel.org/stable/c/2003918e13f43cf6c5698be3cc9aa3657dd676a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/29639f00bfa49da7904ba0a499e0da7a0e5d735e"
        },
        {
          "url": "https://git.kernel.org/stable/c/261d2b5f4afa0570ca906e553c93811c5abe4590"
        },
        {
          "url": "https://git.kernel.org/stable/c/652cea73b7b7b7c622a2be670e44e3c499c6d49f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ea1dcc9418c4e06ce29ed5170596f497ba86872"
        },
        {
          "url": "https://git.kernel.org/stable/c/5949d339f5ec98752d56dcd4e36f619a59d513a5"
        }
      ],
      "title": "perf sched: Fix register_pid() overflow, strcpy, and BUG_ON",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80671",
    "datePublished": "2026-08-28T06:49:11.744Z",
    "dateReserved": "2026-08-26T14:34:25.782Z",
    "dateUpdated": "2026-09-14T11:58:49.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80671",
      "date": "2026-09-15",
      "epss": "0.00158",
      "percentile": "0.0537"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80671\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:52.410\",\"lastModified\":\"2026-09-14T13:18:48.167\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf sched: Fix register_pid() overflow, strcpy, and BUG_ON\\n\\nregister_pid() has several issues when processing untrusted perf.data:\\n\\n1. Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap\\n   to a small value on 32-bit systems when pid is large (e.g.\\n   0x40000000), causing realloc to return a tiny buffer followed by\\n   out-of-bounds writes in the initialization loop.\\n\\n2. Heap buffer overflow: strcpy(task-\u003ecomm, comm) copies the\\n   untrusted comm string into a fixed 20-byte COMM_LEN buffer with\\n   no length check.\\n\\n3. BUG_ON on allocation failure: perf.data is untrusted input, so\\n   allocation failures should be handled gracefully rather than\\n   killing the process.\\n\\n4. Realloc of sched-\u003etasks assigned directly back, leaking the old\\n   pointer on failure; nr_tasks incremented before the realloc,\\n   leaving corrupted state on failure.\\n\\nCap pid at PID_MAX_LIMIT (4194304, matching the kernel\u0027s maximum\\non 64-bit), replace strcpy with strlcpy, guard against NULL comm,\\nreplace BUG_ON with NULL returns using safe realloc patterns, and\\nadd NULL checks in callers that dereference the result.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"tools/perf/builtin-sched.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ec156764d424dd67283c2cd5e9f6f1b8388364ac\",\"lessThan\":\"344e59fc4f2cba6dc04ce5e2a77388645d4ca834\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec156764d424dd67283c2cd5e9f6f1b8388364ac\",\"lessThan\":\"22263d241bad753217d545f8085b7ead52e2873b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec156764d424dd67283c2cd5e9f6f1b8388364ac\",\"lessThan\":\"2003918e13f43cf6c5698be3cc9aa3657dd676a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec156764d424dd67283c2cd5e9f6f1b8388364ac\",\"lessThan\":\"29639f00bfa49da7904ba0a499e0da7a0e5d735e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec156764d424dd67283c2cd5e9f6f1b8388364ac\",\"lessThan\":\"261d2b5f4afa0570ca906e553c93811c5abe4590\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec156764d424dd67283c2cd5e9f6f1b8388364ac\",\"lessThan\":\"652cea73b7b7b7c622a2be670e44e3c499c6d49f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec156764d424dd67283c2cd5e9f6f1b8388364ac\",\"lessThan\":\"5ea1dcc9418c4e06ce29ed5170596f497ba86872\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec156764d424dd67283c2cd5e9f6f1b8388364ac\",\"lessThan\":\"5949d339f5ec98752d56dcd4e36f619a59d513a5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"tools/perf/builtin-sched.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.32\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.32\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.110\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2003918e13f43cf6c5698be3cc9aa3657dd676a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/22263d241bad753217d545f8085b7ead52e2873b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/261d2b5f4afa0570ca906e553c93811c5abe4590\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/29639f00bfa49da7904ba0a499e0da7a0e5d735e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/344e59fc4f2cba6dc04ce5e2a77388645d4ca834\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5949d339f5ec98752d56dcd4e36f619a59d513a5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5ea1dcc9418c4e06ce29ed5170596f497ba86872\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/652cea73b7b7b7c622a2be670e44e3c499c6d49f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T10:51:59+00:00",
      "cve": "CVE-2026-80671",
      "id": "CVE-2026-80671",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: perf sched: Fix register_pid() overflow, strcpy, and BUG_ON",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80671.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:09:58Z",
      "cve": "CVE-2026-80671",
      "id": "CVE-2026-80671",
      "initial_release_date": "2026-08-28T16:34:36Z",
      "product_status:known_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80671",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80671.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.