Vulnerability-Lookup

FKIE_CVE-2026-98339

Vulnerability from fkie_nvd - Published: 2026-10-06 09:18 - Updated: 2026-10-07 07:17

Severity

8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP switches to a channel that already has a BSS entry, cfg80211_update_assoc_bss_entry() removes that entry before rehashing the real one, since the two would otherwise collide in the BSS rbtree. The lookup for that entry also required it to match the connection's BSS type, so an entry advertising e.g. the IBSS capability bit was left in place, and the following cfg80211_rehash_bss() then ran into it: WARN_ON(!cmp) Changing the type shouldn't really happen, but can be triggered by a rogue AP/device, so drop the check and remove any entries matching the comparison.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/0aa44982125c86b47961be5ac1c82eddab8080f3
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1380ee3a202dbb9f8e8b3c3b87eb410450d57799
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/64e23a36d8f04811372365b44cfca325f8e0f4bb
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/65fdb973bd905bc3f5cb045a04c1828f2d2a7e24
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/6ef87a853327434ae1cd9c5a2c27a557fb4047fc
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b377e1000d963e7182a987082b4b06580bd7ac84
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/fb445ec7480da5d2b82bf681e3b4313603722729

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6ef87a853327434ae1cd9c5a2c27a557fb4047fc",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "1380ee3a202dbb9f8e8b3c3b87eb410450d57799",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "fb445ec7480da5d2b82bf681e3b4313603722729",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "65fdb973bd905bc3f5cb045a04c1828f2d2a7e24",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "64e23a36d8f04811372365b44cfca325f8e0f4bb",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "0aa44982125c86b47961be5ac1c82eddab8080f3",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "b377e1000d963e7182a987082b4b06580bd7ac84",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: don\u0027t filter by BSS type when removing stale entries\n\nWhen an assoc AP switches to a channel that already has a BSS entry,\ncfg80211_update_assoc_bss_entry() removes that entry before rehashing\nthe real one, since the two would otherwise collide in the BSS rbtree.\n\nThe lookup for that entry also required it to match the connection\u0027s BSS\ntype, so an entry advertising e.g. the IBSS capability bit was left in\nplace, and the following cfg80211_rehash_bss() then ran into it:\n\n  WARN_ON(!cmp)\n\nChanging the type shouldn\u0027t really happen, but can be triggered by a\nrogue AP/device, so drop the check and remove any entries matching\nthe comparison."
    }
  ],
  "id": "CVE-2026-98339",
  "lastModified": "2026-10-07T07:17:09.540",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-06T09:18:26.560",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0aa44982125c86b47961be5ac1c82eddab8080f3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1380ee3a202dbb9f8e8b3c3b87eb410450d57799"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/64e23a36d8f04811372365b44cfca325f8e0f4bb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/65fdb973bd905bc3f5cb045a04c1828f2d2a7e24"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6ef87a853327434ae1cd9c5a2c27a557fb4047fc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b377e1000d963e7182a987082b4b06580bd7ac84"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fb445ec7480da5d2b82bf681e3b4313603722729"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-98339 (GCVE-0-2026-98339)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50

Title

wifi: cfg80211: don't filter by BSS type when removing stale entries

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 54/100 over 6633 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/6ef87a853327434ae…
https://git.kernel.org/stable/c/1380ee3a202dbb9f8…
https://git.kernel.org/stable/c/fb445ec7480da5d2b…
https://git.kernel.org/stable/c/65fdb973bd905bc3f…
https://git.kernel.org/stable/c/64e23a36d8f048113…
https://git.kernel.org/stable/c/6d2fd26185678038e…
https://git.kernel.org/stable/c/0aa44982125c86b47…
https://git.kernel.org/stable/c/b377e1000d963e718…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f , < 6ef87a853327434ae1cd9c5a2c27a557fb4047fc (git) Affected: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f , < 1380ee3a202dbb9f8e8b3c3b87eb410450d57799 (git) Affected: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f , < fb445ec7480da5d2b82bf681e3b4313603722729 (git) Affected: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f , < 65fdb973bd905bc3f5cb045a04c1828f2d2a7e24 (git) Affected: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f , < 64e23a36d8f04811372365b44cfca325f8e0f4bb (git) Affected: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f , < 6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25 (git) Affected: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f , < 0aa44982125c86b47961be5ac1c82eddab8080f3 (git) Affected: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f , < b377e1000d963e7182a987082b4b06580bd7ac84 (git)
Linux	Linux	Affected: 5.4 Unaffected: 0 , < 5.4 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6ef87a853327434ae1cd9c5a2c27a557fb4047fc",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "1380ee3a202dbb9f8e8b3c3b87eb410450d57799",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "fb445ec7480da5d2b82bf681e3b4313603722729",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "65fdb973bd905bc3f5cb045a04c1828f2d2a7e24",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "64e23a36d8f04811372365b44cfca325f8e0f4bb",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "0aa44982125c86b47961be5ac1c82eddab8080f3",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "b377e1000d963e7182a987082b4b06580bd7ac84",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: don\u0027t filter by BSS type when removing stale entries\n\nWhen an assoc AP switches to a channel that already has a BSS entry,\ncfg80211_update_assoc_bss_entry() removes that entry before rehashing\nthe real one, since the two would otherwise collide in the BSS rbtree.\n\nThe lookup for that entry also required it to match the connection\u0027s BSS\ntype, so an entry advertising e.g. the IBSS capability bit was left in\nplace, and the following cfg80211_rehash_bss() then ran into it:\n\n  WARN_ON(!cmp)\n\nChanging the type shouldn\u0027t really happen, but can be triggered by a\nrogue AP/device, so drop the check and remove any entries matching\nthe comparison."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bad state comes from received 802.11 frames: a beacon/probe response carrying the associated AP\u0027s BSSID+SSID with the IBSS capability bit on another channel, then a CSA beacon that leads to cfg80211_ch_switch_notify() -\u003e cfg80211_update_assoc_bss_entry(). The attacker must be in WiFi radio range.\nAC:L - The attacker produces every step: injecting the colliding scan entry, sending the CSA (beacons are unprotected without beacon protection), then a second CSA or going silent so connection loss calls cfg80211_unlink_bss(). cmp_bss() ignores capability, so the rb_insert_bss() collision always happens.\nPR:N - No credentials are needed. A rogue AP, or an attacker spoofing management beacons of the victim\u0027s AP, triggers mac80211 channel-switch processing and scan-entry creation before any authenticated data exchange.\nUI:N - The victim station only needs to be in its normal associated state. Beacon/CSA processing and the later beacon-loss unlink happen automatically, with no user action.\nS:U - The corruption is confined to cfg80211\u0027s BSS list and rbtree within the same kernel. There is no hypervisor or other security-authority boundary crossed.\nC:H - After the failed rehash the connected BSS has stale rbn pointers. A second CSA makes cfg80211_rehash_bss() rb_erase() that non-member node, rewriting live parent/child links so bss_tree can reference entries later freed on expiry. That is a use-after-free on every rb lookup triggered by a received beacon.\nI:H - The double rb_erase() of the stale cbss-\u003erbn and the list_del() leaving poisoned pointers on a still-referenced BSS corrupt kernel heap metadata (tree links, bss_entries). The resulting use-after-free of cfg80211_internal_bss objects is a write-capable memory-corruption primitive.\nA:H - After cfg80211_rehash_bss() list_del()s the connected BSS, beacon-loss handling calls cfg80211_unlink_bss() -\u003e __cfg80211_unlink_bss() -\u003e list_del_init() on LIST_POISON pointers and faults (oops/panic). WARN_ON(!cmp) also panics with panic_on_warn."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T06:50:08.023Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6ef87a853327434ae1cd9c5a2c27a557fb4047fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/1380ee3a202dbb9f8e8b3c3b87eb410450d57799"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb445ec7480da5d2b82bf681e3b4313603722729"
        },
        {
          "url": "https://git.kernel.org/stable/c/65fdb973bd905bc3f5cb045a04c1828f2d2a7e24"
        },
        {
          "url": "https://git.kernel.org/stable/c/64e23a36d8f04811372365b44cfca325f8e0f4bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aa44982125c86b47961be5ac1c82eddab8080f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/b377e1000d963e7182a987082b4b06580bd7ac84"
        }
      ],
      "title": "wifi: cfg80211: don\u0027t filter by BSS type when removing stale entries",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98339",
    "datePublished": "2026-10-06T08:46:29.998Z",
    "dateReserved": "2026-09-25T10:25:14.342Z",
    "dateUpdated": "2026-10-07T06:50:08.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2026-98339

CVE-2026-98339 (GCVE-0-2026-98339)

Tags

Sightings

Nomenclature

Related by attack behaviour