GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23171 (GCVE-0-2026-23171)

Vulnerability from cvelistv5 – Published: 2026-02-14 16:01 – Updated: 2026-08-05 12:20
VLAI
Title
bonding: fix use-after-free due to enslave fail after slave array update
Summary
In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due to enslave fail after slave array update Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup path which frees the allocated slave memory. Slave update array is supposed to be called last when further enslave failures are not expected. Move it after xdp setup to avoid any problems. It is very easy to reproduce the problem with a simple xdp_pass prog: ip l add bond1 type bond mode balance-xor ip l set bond1 up ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass ip l add dumdum type dummy Then run in parallel: while :; do ip l set dumdum master bond1 1>/dev/null 2>&1; done; mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp "dp=1-1023, flags=syn" The crash happens almost immediately: [ 605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI [ 605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf] [ 605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G B 6.19.0-rc6+ #21 PREEMPT(voluntary) [ 605.602979] Tainted: [B]=BAD_PAGE [ 605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210 [ 605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89 [ 605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213 [ 605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000 [ 605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be [ 605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c [ 605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000 [ 605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84 [ 605.603286] FS: 00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000 [ 605.603319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 605.603343] CR2: 00007f65712fae40 CR3: 000000011371b000 CR4: 0000000000350ef0 [ 605.603373] Call Trace: [ 605.603392] <TASK> [ 605.603410] __dev_queue_xmit+0x448/0x32a0 [ 605.603434] ? __pfx_vprintk_emit+0x10/0x10 [ 605.603461] ? __pfx_vprintk_emit+0x10/0x10 [ 605.603484] ? __pfx___dev_queue_xmit+0x10/0x10 [ 605.603507] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603546] ? _printk+0xcb/0x100 [ 605.603566] ? __pfx__printk+0x10/0x10 [ 605.603589] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603627] ? add_taint+0x5e/0x70 [ 605.603648] ? add_taint+0x2a/0x70 [ 605.603670] ? end_report.cold+0x51/0x75 [ 605.603693] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603731] bond_start_xmit+0x623/0xc20 [bonding]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 20:31 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e , < 172dcb67dd35b162357df229d7806acc724cd469 (git)
Affected: 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e , < 2889d92c5f728351c9930c7996d22fe6e906e785 (git)
Affected: 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e , < bd25b092a06a3e05f7e8bd6da6fa7318777d8c3d (git)
Affected: 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e , < e9acda52fd2ee0cdca332f996da7a95c5fd25294 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.6.140 , ≤ 6.6.* (semver)
Unaffected: 6.12.90 , ≤ 6.12.* (semver)
Unaffected: 6.18.9 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23171",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T20:31:33.690171Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T20:31:44.839Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "172dcb67dd35b162357df229d7806acc724cd469",
              "status": "affected",
              "version": "9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e",
              "versionType": "git"
            },
            {
              "lessThan": "2889d92c5f728351c9930c7996d22fe6e906e785",
              "status": "affected",
              "version": "9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e",
              "versionType": "git"
            },
            {
              "lessThan": "bd25b092a06a3e05f7e8bd6da6fa7318777d8c3d",
              "status": "affected",
              "version": "9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e",
              "versionType": "git"
            },
            {
              "lessThan": "e9acda52fd2ee0cdca332f996da7a95c5fd25294",
              "status": "affected",
              "version": "9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.90",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.9",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: fix use-after-free due to enslave fail after slave array update\n\nFix a use-after-free which happens due to enslave failure after the new\nslave has been added to the array. Since the new slave can be used for Tx\nimmediately, we can use it after it has been freed by the enslave error\ncleanup path which frees the allocated slave memory. Slave update array is\nsupposed to be called last when further enslave failures are not expected.\nMove it after xdp setup to avoid any problems.\n\nIt is very easy to reproduce the problem with a simple xdp_pass prog:\n ip l add bond1 type bond mode balance-xor\n ip l set bond1 up\n ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass\n ip l add dumdum type dummy\n\nThen run in parallel:\n while :; do ip l set dumdum master bond1 1\u003e/dev/null 2\u003e\u00261; done;\n mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp \"dp=1-1023, flags=syn\"\n\nThe crash happens almost immediately:\n [  605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI\n [  605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf]\n [  605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G    B               6.19.0-rc6+ #21 PREEMPT(voluntary)\n [  605.602979] Tainted: [B]=BAD_PAGE\n [  605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n [  605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210\n [  605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89\n [  605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213\n [  605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000\n [  605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be\n [  605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c\n [  605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000\n [  605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84\n [  605.603286] FS:  00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000\n [  605.603319] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n [  605.603343] CR2: 00007f65712fae40 CR3: 000000011371b000 CR4: 0000000000350ef0\n [  605.603373] Call Trace:\n [  605.603392]  \u003cTASK\u003e\n [  605.603410]  __dev_queue_xmit+0x448/0x32a0\n [  605.603434]  ? __pfx_vprintk_emit+0x10/0x10\n [  605.603461]  ? __pfx_vprintk_emit+0x10/0x10\n [  605.603484]  ? __pfx___dev_queue_xmit+0x10/0x10\n [  605.603507]  ? bond_start_xmit+0xbfb/0xc20 [bonding]\n [  605.603546]  ? _printk+0xcb/0x100\n [  605.603566]  ? __pfx__printk+0x10/0x10\n [  605.603589]  ? bond_start_xmit+0xbfb/0xc20 [bonding]\n [  605.603627]  ? add_taint+0x5e/0x70\n [  605.603648]  ? add_taint+0x2a/0x70\n [  605.603670]  ? end_report.cold+0x51/0x75\n [  605.603693]  ? bond_start_xmit+0xbfb/0xc20 [bonding]\n [  605.603731]  bond_start_xmit+0x623/0xc20 [bonding]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered via local netlink operations (ip link set ... master) which requires CAP_NET_ADMIN. This is a local attack vector through syscalls/ioctls, not remotely reachable via network packets.\nAC:L - The attacker controls both sides of the race \u2014 they trigger the enslave operation and the packet transmit concurrently. The commit confirms it is \"very easy to reproduce\" and crashes \"almost immediately.\" The attacker creates and controls the race conditions.\nPR:L - Requires CAP_NET_ADMIN, but this capability is obtainable by an unprivileged local user through user namespaces (unshare -Urn). Bond interfaces, dummy devices, and XDP programs can all be created within a user/network namespace.\nUI:N - No user interaction is required. The attacker can set up the bond device, XDP program, dummy slave, and trigger the race entirely on their own.\nS:U - The vulnerability affects the kernel within its own security scope. There is no crossing of security boundaries such as VM escape or IOMMU bypass.\nC:H - This is a use-after-free where the freed slave struct is accessed through the transmit array. An attacker can reallocate the freed memory with controlled content via heap spray, potentially reading arbitrary kernel memory through the slave struct\u0027s pointer fields.\nI:H - The use-after-free gives the attacker control over the freed slave object\u0027s contents through heap spraying. The Tx path dereferences pointers from the slave struct (e.g., slave-\u003edev), enabling arbitrary write primitives and potential code execution.\nA:H - The vulnerability causes an immediate kernel oops/crash as demonstrated in the commit message, with access to wild memory addresses. This is trivially reproducible for a denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:26.019Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/172dcb67dd35b162357df229d7806acc724cd469"
        },
        {
          "url": "https://git.kernel.org/stable/c/2889d92c5f728351c9930c7996d22fe6e906e785"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd25b092a06a3e05f7e8bd6da6fa7318777d8c3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9acda52fd2ee0cdca332f996da7a95c5fd25294"
        }
      ],
      "title": "bonding: fix use-after-free due to enslave fail after slave array update",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23171",
    "datePublished": "2026-02-14T16:01:33.489Z",
    "dateReserved": "2026-01-13T15:37:45.982Z",
    "dateUpdated": "2026-08-05T12:20:26.019Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23171",
      "date": "2026-09-17",
      "epss": "0.00121",
      "percentile": "0.02228"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T01:45:09.000Z",
      "cve": "CVE-2026-23171",
      "id": "msrc_CVE-2026-23171",
      "initial_release_date": "2026-03-20T01:03:39.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bonding: fix use-after-free due to enslave fail after slave array update",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-23171.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23171\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-14T16:15:57.353\",\"lastModified\":\"2026-06-17T10:21:01.977\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbonding: fix use-after-free due to enslave fail after slave array update\\n\\nFix a use-after-free which happens due to enslave failure after the new\\nslave has been added to the array. Since the new slave can be used for Tx\\nimmediately, we can use it after it has been freed by the enslave error\\ncleanup path which frees the allocated slave memory. Slave update array is\\nsupposed to be called last when further enslave failures are not expected.\\nMove it after xdp setup to avoid any problems.\\n\\nIt is very easy to reproduce the problem with a simple xdp_pass prog:\\n ip l add bond1 type bond mode balance-xor\\n ip l set bond1 up\\n ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass\\n ip l add dumdum type dummy\\n\\nThen run in parallel:\\n while :; do ip l set dumdum master bond1 1\u003e/dev/null 2\u003e\u00261; done;\\n mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp \\\"dp=1-1023, flags=syn\\\"\\n\\nThe crash happens almost immediately:\\n [  605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI\\n [  605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf]\\n [  605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G    B               6.19.0-rc6+ #21 PREEMPT(voluntary)\\n [  605.602979] Tainted: [B]=BAD_PAGE\\n [  605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n [  605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210\\n [  605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89\\n [  605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213\\n [  605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000\\n [  605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be\\n [  605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c\\n [  605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000\\n [  605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84\\n [  605.603286] FS:  00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000\\n [  605.603319] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n [  605.603343] CR2: 00007f65712fae40 CR3: 000000011371b000 CR4: 0000000000350ef0\\n [  605.603373] Call Trace:\\n [  605.603392]  \u003cTASK\u003e\\n [  605.603410]  __dev_queue_xmit+0x448/0x32a0\\n [  605.603434]  ? __pfx_vprintk_emit+0x10/0x10\\n [  605.603461]  ? __pfx_vprintk_emit+0x10/0x10\\n [  605.603484]  ? __pfx___dev_queue_xmit+0x10/0x10\\n [  605.603507]  ? bond_start_xmit+0xbfb/0xc20 [bonding]\\n [  605.603546]  ? _printk+0xcb/0x100\\n [  605.603566]  ? __pfx__printk+0x10/0x10\\n [  605.603589]  ? bond_start_xmit+0xbfb/0xc20 [bonding]\\n [  605.603627]  ? add_taint+0x5e/0x70\\n [  605.603648]  ? add_taint+0x2a/0x70\\n [  605.603670]  ? end_report.cold+0x51/0x75\\n [  605.603693]  ? bond_start_xmit+0xbfb/0xc20 [bonding]\\n [  605.603731]  bond_start_xmit+0x623/0xc20 [bonding]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nbonding: corrige el uso despu\u00e9s de liberaci\u00f3n debido a un fallo de enslave despu\u00e9s de la actualizaci\u00f3n del array de esclavos\\n\\nCorrige un uso despu\u00e9s de liberaci\u00f3n que ocurre debido a un fallo de enslave despu\u00e9s de que el nuevo esclavo ha sido a\u00f1adido al array. Dado que el nuevo esclavo puede ser usado para Tx inmediatamente, podemos usarlo despu\u00e9s de que ha sido liberado por la ruta de limpieza de errores de enslave que libera la memoria del esclavo asignada. Se supone que la actualizaci\u00f3n del array de esclavos debe ser llamada al final cuando no se esperan m\u00e1s fallos de enslave. Mu\u00e9velo despu\u00e9s de la configuraci\u00f3n de xdp para evitar cualquier problema.\\n\\nEs muy f\u00e1cil reproducir el problema con un programa xdp_pass simple:\\n ip l add bond1 type bond mode balance-xor\\n ip l set bond1 up\\n ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass\\n ip l add dumdum type dummy\\n\\nLuego ejecuta en paralelo:\\n while :; do ip l set dumdum master bond1 1\u0026gt;/dev/null 2\u0026gt;\u0026amp;1; done;\\n mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp \u0027dp=1-1023, flags=syn\u0027\\n\\nEl fallo ocurre casi inmediatamente:\\n [  605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI\\n [  605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf]\\n [  605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G    B               6.19.0-rc6+ #21 PREEMPT(voluntary)\\n [  605.602979] Tainted: [B]=BAD_PAGE\\n [  605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n [  605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210\\n [  605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 \u0026lt;80\u0026gt; 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89\\n [  605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213\\n [  605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000\\n [  605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be\\n [  605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c\\n [  605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000\\n [  605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84\\n [  605.603286] FS:  00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000\\n [  605.603319] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n [  605.603343] CR2: 00007f65712fae40 CR3: 000000011371b000 CR4: 0000000000350ef0\\n [  605.603373] Call Trace:\\n [  605.603392]  \\n [  605.603410]  __dev_queue_xmit+0x448/0x32a0\\n [  605.603434]  ? __pfx_vprintk_emit+0x10/0x10\\n [  605.603461]  ? __pfx_vprintk_emit+0x10/0x10\\n [  605.603484]  ? __pfx___dev_queue_xmit+0x10/0x10\\n [  605.603507]  ? bond_start_xmit+0xbfb/0xc20 [bonding]\\n [  605.603546]  ? _printk+0xcb/0x100\\n [  605.603566]  ? __pfx__printk+0x10/0x10\\n [  605.603589]  ? bond_start_xmit+0xbfb/0xc20 [bonding]\\n [  605.603627]  ? add_taint+0x5e/0x70\\n [  605.603648]  ? add_taint+0x2a/0x70\\n [  605.603670]  ? end_report.cold+0x51/0x75\\n [  605.603693]  ? bond_start_xmit+0xbfb/0xc20 [bonding]\\n [  605.603731]  bond_start_xmit+0x623/0xc20 [bonding]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/bonding/bond_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e\",\"lessThan\":\"172dcb67dd35b162357df229d7806acc724cd469\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e\",\"lessThan\":\"2889d92c5f728351c9930c7996d22fe6e906e785\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e\",\"lessThan\":\"bd25b092a06a3e05f7e8bd6da6fa7318777d8c3d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e\",\"lessThan\":\"e9acda52fd2ee0cdca332f996da7a95c5fd25294\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/bonding/bond_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.140\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.90\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.9\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-16T20:31:33.690171Z\",\"id\":\"CVE-2026-23171\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"6.18.9\",\"matchCriteriaId\":\"031C7E01-871A-404A-8849-89C7AEC73CD6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/172dcb67dd35b162357df229d7806acc724cd469\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2889d92c5f728351c9930c7996d22fe6e906e785\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bd25b092a06a3e05f7e8bd6da6fa7318777d8c3d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e9acda52fd2ee0cdca332f996da7a95c5fd25294\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-11T22:31:47+00:00",
      "cve": "CVE-2026-23171",
      "id": "CVE-2026-23171",
      "initial_release_date": "2026-02-14T00:00:00+00:00",
      "product_status:fixed": "1704",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23171.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-23171\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-16T20:31:33.690171Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-16T20:31:39.467Z\"}}], \"cna\": {\"title\": \"bonding: fix use-after-free due to enslave fail after slave array update\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is triggered via local netlink operations (ip link set ... master) which requires CAP_NET_ADMIN. This is a local attack vector through syscalls/ioctls, not remotely reachable via network packets.\\nAC:L - The attacker controls both sides of the race \\u2014 they trigger the enslave operation and the packet transmit concurrently. The commit confirms it is \\\"very easy to reproduce\\\" and crashes \\\"almost immediately.\\\" The attacker creates and controls the race conditions.\\nPR:L - Requires CAP_NET_ADMIN, but this capability is obtainable by an unprivileged local user through user namespaces (unshare -Urn). Bond interfaces, dummy devices, and XDP programs can all be created within a user/network namespace.\\nUI:N - No user interaction is required. The attacker can set up the bond device, XDP program, dummy slave, and trigger the race entirely on their own.\\nS:U - The vulnerability affects the kernel within its own security scope. There is no crossing of security boundaries such as VM escape or IOMMU bypass.\\nC:H - This is a use-after-free where the freed slave struct is accessed through the transmit array. An attacker can reallocate the freed memory with controlled content via heap spray, potentially reading arbitrary kernel memory through the slave struct\u0027s pointer fields.\\nI:H - The use-after-free gives the attacker control over the freed slave object\u0027s contents through heap spraying. The Tx path dereferences pointers from the slave struct (e.g., slave-\u003edev), enabling arbitrary write primitives and potential code execution.\\nA:H - The vulnerability causes an immediate kernel oops/crash as demonstrated in the commit message, with access to wild memory addresses. This is trivially reproducible for a denial of service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e\", \"lessThan\": \"172dcb67dd35b162357df229d7806acc724cd469\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e\", \"lessThan\": \"2889d92c5f728351c9930c7996d22fe6e906e785\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e\", \"lessThan\": \"bd25b092a06a3e05f7e8bd6da6fa7318777d8c3d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e\", \"lessThan\": \"e9acda52fd2ee0cdca332f996da7a95c5fd25294\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/bonding/bond_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.140\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.90\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/bonding/bond_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/172dcb67dd35b162357df229d7806acc724cd469\"}, {\"url\": \"https://git.kernel.org/stable/c/2889d92c5f728351c9930c7996d22fe6e906e785\"}, {\"url\": \"https://git.kernel.org/stable/c/bd25b092a06a3e05f7e8bd6da6fa7318777d8c3d\"}, {\"url\": \"https://git.kernel.org/stable/c/e9acda52fd2ee0cdca332f996da7a95c5fd25294\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbonding: fix use-after-free due to enslave fail after slave array update\\n\\nFix a use-after-free which happens due to enslave failure after the new\\nslave has been added to the array. Since the new slave can be used for Tx\\nimmediately, we can use it after it has been freed by the enslave error\\ncleanup path which frees the allocated slave memory. Slave update array is\\nsupposed to be called last when further enslave failures are not expected.\\nMove it after xdp setup to avoid any problems.\\n\\nIt is very easy to reproduce the problem with a simple xdp_pass prog:\\n ip l add bond1 type bond mode balance-xor\\n ip l set bond1 up\\n ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass\\n ip l add dumdum type dummy\\n\\nThen run in parallel:\\n while :; do ip l set dumdum master bond1 1\u003e/dev/null 2\u003e\u00261; done;\\n mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp \\\"dp=1-1023, flags=syn\\\"\\n\\nThe crash happens almost immediately:\\n [  605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI\\n [  605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf]\\n [  605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G    B               6.19.0-rc6+ #21 PREEMPT(voluntary)\\n [  605.602979] Tainted: [B]=BAD_PAGE\\n [  605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n [  605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210\\n [  605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89\\n [  605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213\\n [  605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000\\n [  605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be\\n [  605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c\\n [  605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000\\n [  605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84\\n [  605.603286] FS:  00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000\\n [  605.603319] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n [  605.603343] CR2: 00007f65712fae40 CR3: 000000011371b000 CR4: 0000000000350ef0\\n [  605.603373] Call Trace:\\n [  605.603392]  \u003cTASK\u003e\\n [  605.603410]  __dev_queue_xmit+0x448/0x32a0\\n [  605.603434]  ? __pfx_vprintk_emit+0x10/0x10\\n [  605.603461]  ? __pfx_vprintk_emit+0x10/0x10\\n [  605.603484]  ? __pfx___dev_queue_xmit+0x10/0x10\\n [  605.603507]  ? bond_start_xmit+0xbfb/0xc20 [bonding]\\n [  605.603546]  ? _printk+0xcb/0x100\\n [  605.603566]  ? __pfx__printk+0x10/0x10\\n [  605.603589]  ? bond_start_xmit+0xbfb/0xc20 [bonding]\\n [  605.603627]  ? add_taint+0x5e/0x70\\n [  605.603648]  ? add_taint+0x2a/0x70\\n [  605.603670]  ? end_report.cold+0x51/0x75\\n [  605.603693]  ? bond_start_xmit+0xbfb/0xc20 [bonding]\\n [  605.603731]  bond_start_xmit+0x623/0xc20 [bonding]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.140\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.90\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.9\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19\", \"versionStartIncluding\": \"5.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:20:26.019Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-23171\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T12:20:26.019Z\", \"dateReserved\": \"2026-01-13T15:37:45.982Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-02-14T16:01:33.489Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.