GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80978 (GCVE-0-2026-80978)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-14 11:59
VLAI
Title
net: cap advertised IP tunnel headroom
Summary
In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can represent. Once IP output reserves it, skb head expansion can wrap those offsets. The runtime transmit path already caps a growing needed_headroom at 512. Apply the same cap when tunnel configuration publishes needed_headroom derived from a lower output device. Capping the advertised value is safe: IP tunnel transmit still expands the skb when a packet needs more headroom. A nonsensical stacked configuration can therefore incur an extra reallocation, but it cannot publish an unbounded reservation to upper layers.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1a37e412a0225fcba5587f24c0dfc7636efc8b69 , < fb889a619723032140f5d983a3a34d25a5a2bed4 (git)
Affected: 1a37e412a0225fcba5587f24c0dfc7636efc8b69 , < b160422f8103574425e2834130e169d84c94fa1d (git)
Affected: 1a37e412a0225fcba5587f24c0dfc7636efc8b69 , < d36e75f5669140b66515ad3a176ca6337bd80a5e (git)
Affected: 1a37e412a0225fcba5587f24c0dfc7636efc8b69 , < 84783961cb8bdb36b4f41a02ce43aafc6d52b176 (git)
Affected: 1a37e412a0225fcba5587f24c0dfc7636efc8b69 , < bc4e05ae66c9797a0972ac44326e69c5305e0020 (git)
Affected: 1a37e412a0225fcba5587f24c0dfc7636efc8b69 , < af0ee8f04bea22cdb331fa3509e17f81b48938ad (git)
Affected: 1a37e412a0225fcba5587f24c0dfc7636efc8b69 , < 9144f2c53a04465a6878172b523f640313c5559e (git)
Affected: 1a37e412a0225fcba5587f24c0dfc7636efc8b69 , < 6b222adeb9340306e2ff97127c76117abb9b3df8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.11
Unaffected: 0 , < 3.11 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip_tunnels.h",
            "net/ipv4/ip_tunnel.c",
            "net/ipv6/ip6_gre.c",
            "net/ipv6/ip6_tunnel.c",
            "net/ipv6/sit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fb889a619723032140f5d983a3a34d25a5a2bed4",
              "status": "affected",
              "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69",
              "versionType": "git"
            },
            {
              "lessThan": "b160422f8103574425e2834130e169d84c94fa1d",
              "status": "affected",
              "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69",
              "versionType": "git"
            },
            {
              "lessThan": "d36e75f5669140b66515ad3a176ca6337bd80a5e",
              "status": "affected",
              "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69",
              "versionType": "git"
            },
            {
              "lessThan": "84783961cb8bdb36b4f41a02ce43aafc6d52b176",
              "status": "affected",
              "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69",
              "versionType": "git"
            },
            {
              "lessThan": "bc4e05ae66c9797a0972ac44326e69c5305e0020",
              "status": "affected",
              "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69",
              "versionType": "git"
            },
            {
              "lessThan": "af0ee8f04bea22cdb331fa3509e17f81b48938ad",
              "status": "affected",
              "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69",
              "versionType": "git"
            },
            {
              "lessThan": "9144f2c53a04465a6878172b523f640313c5559e",
              "status": "affected",
              "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69",
              "versionType": "git"
            },
            {
              "lessThan": "6b222adeb9340306e2ff97127c76117abb9b3df8",
              "status": "affected",
              "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip_tunnels.h",
            "net/ipv4/ip_tunnel.c",
            "net/ipv6/ip6_gre.c",
            "net/ipv6/ip6_tunnel.c",
            "net/ipv6/sit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: cap advertised IP tunnel headroom\n\nIP tunnel devices derive their advertised needed_headroom from lower\noutput devices. A stack of user-created devices can make the derived\nvalue larger than the 16-bit skb header offsets can represent. Once IP\noutput reserves it, skb head expansion can wrap those offsets.\n\nThe runtime transmit path already caps a growing needed_headroom at 512.\nApply the same cap when tunnel configuration publishes needed_headroom\nderived from a lower output device.\n\nCapping the advertised value is safe: IP tunnel transmit still expands\nthe skb when a packet needs more headroom. A nonsensical stacked\nconfiguration can therefore incur an extra reallocation, but it cannot\npublish an unbounded reservation to upper layers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggering the wrap requires locally creating a namespace stack of IP tunnel devices (ipip/gre/sit/ip6tnl via rtnetlink or SIOCADDTUNNEL) so bind/link-config can copy an uncapped needed_headroom, then sending packets through that stack. A remote peer cannot build that topology, so the attacker-controlled path is local.\nAC:L - The attacker fully controls tunnel creation, IFLA_IPTUN_LINK/parms.link stacking (or a netkit lower device with a large IFLA_NETKIT_HEADROOM), and the subsequent transmit. Each bind copies lower needed_headroom plus t_hlen until LL_RESERVED_SPACE exceeds 16-bit skb offsets; no race or uninfluenced victim state is required.\nPR:L - Creating and binding these tunnels needs CAP_NET_ADMIN, but rtnetlink uses netlink_ns_capable()/sk_ns_capable() against net-\u003euser_ns and ip_tunnel_ctl uses ns_capable(net-\u003euser_ns, CAP_NET_ADMIN), so an unprivileged user obtains it with unshare -Urn. Fallback tunl0/ip6tnl0 devices are created in every netns by default.\nUI:N - The attacker creates the stacked tunnels and generates the traffic that drives IP output/skb_cow_head; no other user or administrator action is required.\nS:U - The resulting skb header-offset wrap corrupts kernel heap in the same OS security authority. This is standard in-kernel privilege escalation, not a VM, IOMMU, or hypervisor boundary crossing.\nC:H - After pskb_expand_head adds a \u003e64K nhead, u16 network_header wraps so skb-\u003edata points outside skb-\u003ehead. Neighbour/flow-dissect paths then __skb_pull/read with a negative offset, producing the same unbounded KASAN use-after-free/OOB read as CVE-2024-26804/CVE-2025-40173.\nI:H - Post-wrap, skb_push/dev_hard_header and iptunnel_xmit/ip6_tnl_xmit write outer IP/GRE headers at the corrupted skb-\u003edata, giving an out-of-bounds write into unrelated kernel heap that can be used for control-flow hijacking.\nA:H - The wrapped offsets and subsequent out-of-bounds accesses reliably oops/panic (KASAN, skb_under_panic, or unmapped dereference), matching the confirmed crash impact of the earlier unbounded tunnel-headroom bugs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:59:23.543Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fb889a619723032140f5d983a3a34d25a5a2bed4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b160422f8103574425e2834130e169d84c94fa1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d36e75f5669140b66515ad3a176ca6337bd80a5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/84783961cb8bdb36b4f41a02ce43aafc6d52b176"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc4e05ae66c9797a0972ac44326e69c5305e0020"
        },
        {
          "url": "https://git.kernel.org/stable/c/af0ee8f04bea22cdb331fa3509e17f81b48938ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/9144f2c53a04465a6878172b523f640313c5559e"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b222adeb9340306e2ff97127c76117abb9b3df8"
        }
      ],
      "title": "net: cap advertised IP tunnel headroom",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80978",
    "datePublished": "2026-09-11T19:42:39.496Z",
    "dateReserved": "2026-08-26T14:34:25.811Z",
    "dateUpdated": "2026-09-14T11:59:23.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80978",
      "date": "2026-09-17",
      "epss": "0.00129",
      "percentile": "0.02908"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/ip_tunnels.h",
                  "net/ipv4/ip_tunnel.c",
                  "net/ipv6/ip6_gre.c",
                  "net/ipv6/ip6_tunnel.c",
                  "net/ipv6/sit.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "fb889a619723032140f5d983a3a34d25a5a2bed4",
                    "status": "affected",
                    "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b160422f8103574425e2834130e169d84c94fa1d",
                    "status": "affected",
                    "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d36e75f5669140b66515ad3a176ca6337bd80a5e",
                    "status": "affected",
                    "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "84783961cb8bdb36b4f41a02ce43aafc6d52b176",
                    "status": "affected",
                    "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bc4e05ae66c9797a0972ac44326e69c5305e0020",
                    "status": "affected",
                    "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "af0ee8f04bea22cdb331fa3509e17f81b48938ad",
                    "status": "affected",
                    "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9144f2c53a04465a6878172b523f640313c5559e",
                    "status": "affected",
                    "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6b222adeb9340306e2ff97127c76117abb9b3df8",
                    "status": "affected",
                    "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/ip_tunnels.h",
                  "net/ipv4/ip_tunnel.c",
                  "net/ipv6/ip6_gre.c",
                  "net/ipv6/ip6_tunnel.c",
                  "net/ipv6/sit.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.11"
                  },
                  {
                    "lessThan": "3.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: cap advertised IP tunnel headroom\n\nIP tunnel devices derive their advertised needed_headroom from lower\noutput devices. A stack of user-created devices can make the derived\nvalue larger than the 16-bit skb header offsets can represent. Once IP\noutput reserves it, skb head expansion can wrap those offsets.\n\nThe runtime transmit path already caps a growing needed_headroom at 512.\nApply the same cap when tunnel configuration publishes needed_headroom\nderived from a lower output device.\n\nCapping the advertised value is safe: IP tunnel transmit still expands\nthe skb when a packet needs more headroom. A nonsensical stacked\nconfiguration can therefore incur an extra reallocation, but it cannot\npublish an unbounded reservation to upper layers."
          }
        ],
        "id": "CVE-2026-80978",
        "lastModified": "2026-09-14T13:18:52.650",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:04.143",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6b222adeb9340306e2ff97127c76117abb9b3df8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/84783961cb8bdb36b4f41a02ce43aafc6d52b176"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9144f2c53a04465a6878172b523f640313c5559e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/af0ee8f04bea22cdb331fa3509e17f81b48938ad"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b160422f8103574425e2834130e169d84c94fa1d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bc4e05ae66c9797a0972ac44326e69c5305e0020"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d36e75f5669140b66515ad3a176ca6337bd80a5e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fb889a619723032140f5d983a3a34d25a5a2bed4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T18:58:28+00:00",
      "cve": "CVE-2026-80978",
      "id": "CVE-2026-80978",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: cap advertised IP tunnel headroom",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80978.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:04:55Z",
      "cve": "CVE-2026-80978",
      "id": "CVE-2026-80978",
      "initial_release_date": "2026-09-12T16:36:24Z",
      "product_status:known_affected": "349",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80978",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80978.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.