GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-90011 (GCVE-0-2026-90011)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41
VLAI
Title
scsi: target: iscsi: Reserve a terminator byte for the login payload
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS bytes. Since iscsit_get_login_rx() receives payload_length + padding bytes, where padding = ((-payload_length) & 3); any payload_length from 8189 to 8192 fills the whole 8192 byte buffer. The write stays in bounds, but no byte is left for a NUL terminator. The buffer is subsequently consumed as a C string. In the CHAP path chap_check_algorithm() calls kstrdup(a_str), and extract_param() calls strstr(in_buf, pattern) followed by strlen_semi(), none of which take a length. convert_null_to_semi() additionally rewrites every embedded NUL to ';', so even a payload made of well formed NUL separated key=value records is left without a terminator. These walk past the end of the object into adjacent slab memory. It is reachable by an unauthenticated initiator against a portal configured for CHAP; when authentication is not required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and the CHAP path is never entered. Allocate one extra byte. kzalloc() zeroes it and nothing ever writes to it, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS bytes, so the buffer is always terminated.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e48354ce078c079996f89d715dfa44814b4eba01 , < 5fac79f248c37774d1dd761406f83d25ca6ff8e4 (git)
Affected: e48354ce078c079996f89d715dfa44814b4eba01 , < 6ddddcad436d8e6e619204d3c848147ff2f5bf1e (git)
Affected: e48354ce078c079996f89d715dfa44814b4eba01 , < b19dc17ed963ac36c0db4b52a1803fb11169f91f (git)
Affected: e48354ce078c079996f89d715dfa44814b4eba01 , < 6b589ef9d5f6cdc70d2b4f269ca6cf26b5ebb076 (git)
Affected: e48354ce078c079996f89d715dfa44814b4eba01 , < eb9dadf4d552ebe10644871c5189286552aa48f5 (git)
Affected: e48354ce078c079996f89d715dfa44814b4eba01 , < 1624bff4c5118ad494d50ad94d44f22064667a7f (git)
Affected: e48354ce078c079996f89d715dfa44814b4eba01 , < 3ddf3ea291a0ef2ea93b82e158960ac2cc42302b (git)
Affected: e48354ce078c079996f89d715dfa44814b4eba01 , < f4825922d2fb371e2b969697d792077f1b62b62c (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.1
Unaffected: 0 , < 3.1 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target_login.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5fac79f248c37774d1dd761406f83d25ca6ff8e4",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "6ddddcad436d8e6e619204d3c848147ff2f5bf1e",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "b19dc17ed963ac36c0db4b52a1803fb11169f91f",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "6b589ef9d5f6cdc70d2b4f269ca6cf26b5ebb076",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "eb9dadf4d552ebe10644871c5189286552aa48f5",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "1624bff4c5118ad494d50ad94d44f22064667a7f",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "3ddf3ea291a0ef2ea93b82e158960ac2cc42302b",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            },
            {
              "lessThan": "f4825922d2fb371e2b969697d792077f1b62b62c",
              "status": "affected",
              "version": "e48354ce078c079996f89d715dfa44814b4eba01",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target_login.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc2",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Reserve a terminator byte for the login payload\n\niscsi_target_check_login_request() rejects a login PDU whose\nDataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is \u0027\u003e\u0027 and\nlogin-\u003ereq_buf is allocated with exactly MAX_KEY_VALUE_PAIRS\nbytes. Since iscsit_get_login_rx() receives payload_length + padding\nbytes, where\n\n\tpadding = ((-payload_length) \u0026 3);\n\nany payload_length from 8189 to 8192 fills the whole 8192 byte\nbuffer. The write stays in bounds, but no byte is left for a NUL\nterminator.\n\nThe buffer is subsequently consumed as a C string. In the CHAP path\nchap_check_algorithm() calls kstrdup(a_str), and extract_param() calls\nstrstr(in_buf, pattern) followed by strlen_semi(), none of which take a\nlength. convert_null_to_semi() additionally rewrites every embedded NUL\nto \u0027;\u0027, so even a payload made of well formed NUL separated key=value\nrecords is left without a terminator. These walk past the end of the\nobject into adjacent slab memory. It is reachable by an unauthenticated\ninitiator against a portal configured for CHAP; when authentication is\nnot required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and\nthe CHAP path is never entered.\n\nAllocate one extra byte. kzalloc() zeroes it and nothing ever writes to\nit, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS\nbytes, so the buffer is always terminated."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The LIO in-kernel iSCSI target accepts remote TCP connections on the iSCSI portal (typically port 3260); a crafted Login PDU is received by iscsit_accept_np()/iscsit_get_login_rx() and reaches the CHAP parsers over the network, the same exposure model as nfsd or ksmbd.\nAC:L - The attacker fully controls DataSegmentLength and the login payload. A CHAP_A PDU of 8189-8192 bytes with no NUL, or a second CHAP round where convert_null_to_semi() strips every terminator, makes kstrdup()/strstr() over-read adjacent slab deterministically; no race or victim-side layout is required.\nPR:N - The over-read runs in the CHAP login handshake before the password hash is checked, so no Linux account or capability is needed. Default TPG authentication is CHAP (TA_AUTHENTICATION=1), and chap_server_open() proceeds once target-side CHAP credentials exist, which is the normal CHAP deployment.\nUI:N - The attacker opens a TCP connection to the listening portal and sends the malicious Login PDUs; no victim user action such as mounting a volume or accepting a prompt is required.\nS:U - The unbounded C-string over-read and any resulting kernel oops stay inside the host iSCSI target\u0027s kernel security authority and do not by themselves cross a VM, IOMMU, or sandbox boundary.\nC:H - chap_check_algorithm() kstrdup()s the unterminated 8192-byte req_buf, and extract_param() uses unbounded strstr()/strlen_semi() after convert_null_to_semi() removes embedded NULs, producing an unbounded out-of-bounds read of adjacent kmalloc-8k slab that can disclose neighboring kernel objects.\nI:N - iscsit_get_login_rx() copies at most MAX_KEY_VALUE_PAIRS bytes into req_buf, so the network write stays in bounds; convert_null_to_semi() also writes only within payload_length. There is no out-of-bounds write or control-flow hijack primitive.\nA:H - strlen()/kstrdup()/strstr() walking past the kmalloc-8k login object into unmapped or guard pages causes a kernel oops, and the attacker can repeat the unauthenticated login against an exposed portal, denying service to the host and its iSCSI clients."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:41:28.132Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5fac79f248c37774d1dd761406f83d25ca6ff8e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ddddcad436d8e6e619204d3c848147ff2f5bf1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b19dc17ed963ac36c0db4b52a1803fb11169f91f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b589ef9d5f6cdc70d2b4f269ca6cf26b5ebb076"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb9dadf4d552ebe10644871c5189286552aa48f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/1624bff4c5118ad494d50ad94d44f22064667a7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ddf3ea291a0ef2ea93b82e158960ac2cc42302b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4825922d2fb371e2b969697d792077f1b62b62c"
        }
      ],
      "title": "scsi: target: iscsi: Reserve a terminator byte for the login payload",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90011",
    "datePublished": "2026-09-16T10:33:18.793Z",
    "dateReserved": "2026-09-11T19:38:34.781Z",
    "dateUpdated": "2026-09-16T14:41:28.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90011",
      "date": "2026-09-17",
      "epss": "0.00829",
      "percentile": "0.55806"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-17T01:06:43.000Z",
      "cve": "CVE-2026-90011",
      "id": "msrc_CVE-2026-90011",
      "initial_release_date": "2026-09-17T01:06:43.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: target: iscsi: Reserve a terminator byte for the login payload",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90011.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-90011\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-16T11:17:13.760\",\"lastModified\":\"2026-09-16T15:18:24.763\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: target: iscsi: Reserve a terminator byte for the login payload\\n\\niscsi_target_check_login_request() rejects a login PDU whose\\nDataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is \u0027\u003e\u0027 and\\nlogin-\u003ereq_buf is allocated with exactly MAX_KEY_VALUE_PAIRS\\nbytes. Since iscsit_get_login_rx() receives payload_length + padding\\nbytes, where\\n\\n\\tpadding = ((-payload_length) \u0026 3);\\n\\nany payload_length from 8189 to 8192 fills the whole 8192 byte\\nbuffer. The write stays in bounds, but no byte is left for a NUL\\nterminator.\\n\\nThe buffer is subsequently consumed as a C string. In the CHAP path\\nchap_check_algorithm() calls kstrdup(a_str), and extract_param() calls\\nstrstr(in_buf, pattern) followed by strlen_semi(), none of which take a\\nlength. convert_null_to_semi() additionally rewrites every embedded NUL\\nto \u0027;\u0027, so even a payload made of well formed NUL separated key=value\\nrecords is left without a terminator. These walk past the end of the\\nobject into adjacent slab memory. It is reachable by an unauthenticated\\ninitiator against a portal configured for CHAP; when authentication is\\nnot required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and\\nthe CHAP path is never entered.\\n\\nAllocate one extra byte. kzalloc() zeroes it and nothing ever writes to\\nit, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS\\nbytes, so the buffer is always terminated.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/target/iscsi/iscsi_target_login.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e48354ce078c079996f89d715dfa44814b4eba01\",\"lessThan\":\"5fac79f248c37774d1dd761406f83d25ca6ff8e4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e48354ce078c079996f89d715dfa44814b4eba01\",\"lessThan\":\"6ddddcad436d8e6e619204d3c848147ff2f5bf1e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e48354ce078c079996f89d715dfa44814b4eba01\",\"lessThan\":\"b19dc17ed963ac36c0db4b52a1803fb11169f91f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e48354ce078c079996f89d715dfa44814b4eba01\",\"lessThan\":\"6b589ef9d5f6cdc70d2b4f269ca6cf26b5ebb076\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e48354ce078c079996f89d715dfa44814b4eba01\",\"lessThan\":\"eb9dadf4d552ebe10644871c5189286552aa48f5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e48354ce078c079996f89d715dfa44814b4eba01\",\"lessThan\":\"1624bff4c5118ad494d50ad94d44f22064667a7f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e48354ce078c079996f89d715dfa44814b4eba01\",\"lessThan\":\"3ddf3ea291a0ef2ea93b82e158960ac2cc42302b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e48354ce078c079996f89d715dfa44814b4eba01\",\"lessThan\":\"f4825922d2fb371e2b969697d792077f1b62b62c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/target/iscsi/iscsi_target_login.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.110\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.5\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1624bff4c5118ad494d50ad94d44f22064667a7f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3ddf3ea291a0ef2ea93b82e158960ac2cc42302b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5fac79f248c37774d1dd761406f83d25ca6ff8e4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6b589ef9d5f6cdc70d2b4f269ca6cf26b5ebb076\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6ddddcad436d8e6e619204d3c848147ff2f5bf1e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b19dc17ed963ac36c0db4b52a1803fb11169f91f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eb9dadf4d552ebe10644871c5189286552aa48f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f4825922d2fb371e2b969697d792077f1b62b62c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.