GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89485 (GCVE-0-2026-89485)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:43 – Updated: 2026-09-14 12:00
VLAI
Title
lockd: pin next file across nlm_inspect_file lock-drop
Summary
In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file lock-drop nlm_traverse_files() pins the current file with f_count++ across a mutex_unlock for nlm_inspect_file(), but nothing pins the saved next pointer. A concurrent nlm_release_file() can kfree the next file during the unlock window, and the iterator dereferences freed memory on the next loop step. Pin both current and next before the lock-drop. Advance by swapping the pinned cursors at the end of each iteration so next is always held alive across the unlock. Always call nlm_file_release() after dropping the iteration pin, regardless of whether the file matched the predicate. Use nlm_file_inuse(), which does a live walk of the inode lock list, rather than the cached f_locks field, so skipped files that never ran nlm_inspect_file() are evaluated correctly. Because every file in a hash bucket is now pinned and released, files skipped by the is_failover_file predicate that have no locks, blocks, shares, or external references are deleted during traversal. The old code never evaluated skipped files for cleanup. The new behavior is intentional: such files are stale and should not persist in the table.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 01df9c5e918ae5559f2d96da0143f8bfbb9e6171 , < e3c413f789eaf0170275c7eba523ead73d963f30 (git)
Affected: 01df9c5e918ae5559f2d96da0143f8bfbb9e6171 , < 08a455f87b14c7ff22ae3fdadda62a796a3a5572 (git)
Affected: 01df9c5e918ae5559f2d96da0143f8bfbb9e6171 , < 550c19222c7132c888e23c9d89079ba1c9bc4cca (git)
Affected: 01df9c5e918ae5559f2d96da0143f8bfbb9e6171 , < 350087f231c11efcd288c310707c40eab63ca583 (git)
Affected: 01df9c5e918ae5559f2d96da0143f8bfbb9e6171 , < c24bdb7df2f34bdc38ca8a73796f5acb40f1830c (git)
Affected: 01df9c5e918ae5559f2d96da0143f8bfbb9e6171 , < 41f0a6d31615fcae261bf28a0aa50050dc93a401 (git)
Affected: 01df9c5e918ae5559f2d96da0143f8bfbb9e6171 , < e999a88133654c6dfc68487fb49da5f20dfa2d4f (git)
Affected: 01df9c5e918ae5559f2d96da0143f8bfbb9e6171 , < 526c49cff3f72c3ec74752016380c7567040581b (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.18
Unaffected: 0 , < 2.6.18 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/lockd/svcsubs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e3c413f789eaf0170275c7eba523ead73d963f30",
              "status": "affected",
              "version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
              "versionType": "git"
            },
            {
              "lessThan": "08a455f87b14c7ff22ae3fdadda62a796a3a5572",
              "status": "affected",
              "version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
              "versionType": "git"
            },
            {
              "lessThan": "550c19222c7132c888e23c9d89079ba1c9bc4cca",
              "status": "affected",
              "version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
              "versionType": "git"
            },
            {
              "lessThan": "350087f231c11efcd288c310707c40eab63ca583",
              "status": "affected",
              "version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
              "versionType": "git"
            },
            {
              "lessThan": "c24bdb7df2f34bdc38ca8a73796f5acb40f1830c",
              "status": "affected",
              "version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
              "versionType": "git"
            },
            {
              "lessThan": "41f0a6d31615fcae261bf28a0aa50050dc93a401",
              "status": "affected",
              "version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
              "versionType": "git"
            },
            {
              "lessThan": "e999a88133654c6dfc68487fb49da5f20dfa2d4f",
              "status": "affected",
              "version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
              "versionType": "git"
            },
            {
              "lessThan": "526c49cff3f72c3ec74752016380c7567040581b",
              "status": "affected",
              "version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/lockd/svcsubs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.18"
            },
            {
              "lessThan": "2.6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlockd: pin next file across nlm_inspect_file lock-drop\n\nnlm_traverse_files() pins the current file with f_count++ across\na mutex_unlock for nlm_inspect_file(), but nothing pins the saved\nnext pointer.  A concurrent nlm_release_file() can kfree the next\nfile during the unlock window, and the iterator dereferences freed\nmemory on the next loop step.\n\nPin both current and next before the lock-drop.  Advance by\nswapping the pinned cursors at the end of each iteration so next\nis always held alive across the unlock.\n\nAlways call nlm_file_release() after dropping the iteration pin,\nregardless of whether the file matched the predicate.  Use\nnlm_file_inuse(), which does a live walk of the inode lock list,\nrather than the cached f_locks field, so skipped files that never\nran nlm_inspect_file() are evaluated correctly.\n\nBecause every file in a hash bucket is now pinned and released,\nfiles skipped by the is_failover_file predicate that have no\nlocks, blocks, shares, or external references are deleted during\ntraversal.  The old code never evaluated skipped files for\ncleanup.  The new behavior is intentional: such files are stale\nand should not persist in the table."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - lockd is the in-kernel NLM RPC server on TCP/UDP, reached by remote NFSv3 clients. nlm_traverse_files() runs on NLMPROC_FREE_ALL, and nlm_release_file() runs from LOCK/UNLOCK/TEST and from rpciod NLM_GRANTED_MSG completion, so the UAF is triggered by network NLM traffic.\nAC:L - A remote NFS client can populate nlm_files via LOCK, send FREE_ALL to drop nlm_file_mutex inside nlm_traverse_files(), and concurrently complete in-flight GRANTED_MSG callbacks so rpciod\u0027s nlmsvc_grant_release() calls nlm_release_file() on the unpinned next object; the attacker drives both sides of the race.\nPR:N - lockd_authenticate() accepts RPC_AUTH_NULL and RPC_AUTH_UNIX. FREE_ALL is not a privileged-port callback, and nlm_fopen() opens files with NFSD_MAY_BYPASS_GSS|NFSD_MAY_NLM, so no host account or capability is required.\nUI:N - Exploitation uses only attacker-sent NLM RPCs (LOCK/FREE_ALL and grant-callback completion); no victim user or administrator action is required.\nS:U - The use-after-free is in the host kernel\u0027s lockd file table and impacts that same kernel; it does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - The iterator dereferences a kfree\u0027d struct nlm_file (list pointers, f_file[], f_count). This UAF lets an attacker reuse the slab object and obtain a kernel read primitive, so confidentiality impact is high.\nI:H - The same nlm_file UAF is a kernel heap free of list nodes, mutex state, and struct file pointers, which can be sprayed for an arbitrary write and control-flow hijack, so integrity impact is high.\nA:H - Walking the freed nlm_file in nlm_traverse_files() causes a kernel oops/panic (KASAN slab-use-after-free), so availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:00:21.375Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e3c413f789eaf0170275c7eba523ead73d963f30"
        },
        {
          "url": "https://git.kernel.org/stable/c/08a455f87b14c7ff22ae3fdadda62a796a3a5572"
        },
        {
          "url": "https://git.kernel.org/stable/c/550c19222c7132c888e23c9d89079ba1c9bc4cca"
        },
        {
          "url": "https://git.kernel.org/stable/c/350087f231c11efcd288c310707c40eab63ca583"
        },
        {
          "url": "https://git.kernel.org/stable/c/c24bdb7df2f34bdc38ca8a73796f5acb40f1830c"
        },
        {
          "url": "https://git.kernel.org/stable/c/41f0a6d31615fcae261bf28a0aa50050dc93a401"
        },
        {
          "url": "https://git.kernel.org/stable/c/e999a88133654c6dfc68487fb49da5f20dfa2d4f"
        },
        {
          "url": "https://git.kernel.org/stable/c/526c49cff3f72c3ec74752016380c7567040581b"
        }
      ],
      "title": "lockd: pin next file across nlm_inspect_file lock-drop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89485",
    "datePublished": "2026-09-11T19:43:39.403Z",
    "dateReserved": "2026-09-11T19:38:34.712Z",
    "dateUpdated": "2026-09-14T12:00:21.375Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89485",
      "date": "2026-09-16",
      "epss": "0.00704",
      "percentile": "0.51596"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89485\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:30.173\",\"lastModified\":\"2026-09-14T13:19:05.300\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlockd: pin next file across nlm_inspect_file lock-drop\\n\\nnlm_traverse_files() pins the current file with f_count++ across\\na mutex_unlock for nlm_inspect_file(), but nothing pins the saved\\nnext pointer.  A concurrent nlm_release_file() can kfree the next\\nfile during the unlock window, and the iterator dereferences freed\\nmemory on the next loop step.\\n\\nPin both current and next before the lock-drop.  Advance by\\nswapping the pinned cursors at the end of each iteration so next\\nis always held alive across the unlock.\\n\\nAlways call nlm_file_release() after dropping the iteration pin,\\nregardless of whether the file matched the predicate.  Use\\nnlm_file_inuse(), which does a live walk of the inode lock list,\\nrather than the cached f_locks field, so skipped files that never\\nran nlm_inspect_file() are evaluated correctly.\\n\\nBecause every file in a hash bucket is now pinned and released,\\nfiles skipped by the is_failover_file predicate that have no\\nlocks, blocks, shares, or external references are deleted during\\ntraversal.  The old code never evaluated skipped files for\\ncleanup.  The new behavior is intentional: such files are stale\\nand should not persist in the table.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/lockd/svcsubs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"01df9c5e918ae5559f2d96da0143f8bfbb9e6171\",\"lessThan\":\"e3c413f789eaf0170275c7eba523ead73d963f30\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01df9c5e918ae5559f2d96da0143f8bfbb9e6171\",\"lessThan\":\"08a455f87b14c7ff22ae3fdadda62a796a3a5572\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01df9c5e918ae5559f2d96da0143f8bfbb9e6171\",\"lessThan\":\"550c19222c7132c888e23c9d89079ba1c9bc4cca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01df9c5e918ae5559f2d96da0143f8bfbb9e6171\",\"lessThan\":\"350087f231c11efcd288c310707c40eab63ca583\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01df9c5e918ae5559f2d96da0143f8bfbb9e6171\",\"lessThan\":\"c24bdb7df2f34bdc38ca8a73796f5acb40f1830c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01df9c5e918ae5559f2d96da0143f8bfbb9e6171\",\"lessThan\":\"41f0a6d31615fcae261bf28a0aa50050dc93a401\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01df9c5e918ae5559f2d96da0143f8bfbb9e6171\",\"lessThan\":\"e999a88133654c6dfc68487fb49da5f20dfa2d4f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01df9c5e918ae5559f2d96da0143f8bfbb9e6171\",\"lessThan\":\"526c49cff3f72c3ec74752016380c7567040581b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/lockd/svcsubs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08a455f87b14c7ff22ae3fdadda62a796a3a5572\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/350087f231c11efcd288c310707c40eab63ca583\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/41f0a6d31615fcae261bf28a0aa50050dc93a401\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/526c49cff3f72c3ec74752016380c7567040581b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/550c19222c7132c888e23c9d89079ba1c9bc4cca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c24bdb7df2f34bdc38ca8a73796f5acb40f1830c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e3c413f789eaf0170275c7eba523ead73d963f30\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e999a88133654c6dfc68487fb49da5f20dfa2d4f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:56:14+00:00",
      "cve": "CVE-2026-89485",
      "id": "CVE-2026-89485",
      "initial_release_date": "2026-09-11T19:43:39.403000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: lockd use-after-free vulnerability leading to system instability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89485.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T00:03:06Z",
      "cve": "CVE-2026-89485",
      "id": "CVE-2026-89485",
      "initial_release_date": "2026-09-12T16:27:39Z",
      "product_status:known_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89485",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89485.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.