CVE-2026-74540 (GCVE-0-2026-74540)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-10-16 19:05
VLAI
EPSS
VEX
Title
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
l2cap_le_connect_rsp() obtains a channel via
__l2cap_get_chan_by_ident() but neither holds a reference nor uses
l2cap_chan_hold_unless_zero() before locking and operating on it.
A concurrent l2cap_chan_del() triggered by a remote disconnect can
free the channel between the lookup and l2cap_chan_lock(), causing
a use-after-free.
The BR/EDR counterpart l2cap_connect_rsp() and the sibling handler
l2cap_le_command_rej() already use l2cap_chan_hold_unless_zero()
to safely hold a reference, but l2cap_le_connect_rsp() was left
unprotected.
Fix by adding l2cap_chan_hold_unless_zero() after the ident lookup
and l2cap_chan_put() on the exit path, consistent with other L2CAP
response handlers.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 18:59 UTC
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
f1496dee9cbde2a62821f4441dadb0d3360f60c3 , < 15d6c2367217a6a20b1abae9f38ded716bf620f1
(git)
Affected: f1496dee9cbde2a62821f4441dadb0d3360f60c3 , < 1818180fe12d6cec7a437bc59cde8efdf6b10250 (git) Affected: f1496dee9cbde2a62821f4441dadb0d3360f60c3 , < 8325eafb38c3dee5af329266393763693d17381b (git) Affected: f1496dee9cbde2a62821f4441dadb0d3360f60c3 , < fd4c1e301bdec60a40728ea37de531cbccda501a (git) Affected: f1496dee9cbde2a62821f4441dadb0d3360f60c3 , < 522b730c62c53a1981604fd73524697fd347830d (git) Affected: f1496dee9cbde2a62821f4441dadb0d3360f60c3 , < 58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136 (git) Affected: f1496dee9cbde2a62821f4441dadb0d3360f60c3 , < 09f447accc2570751e7d17f0dc0788b40d3edade (git) Affected: f1496dee9cbde2a62821f4441dadb0d3360f60c3 , < c4740e7f23ff9a8210198d8b4703259e21b9f69d (git) |
guessed | |
| Linux | Linux |
Affected:
3.14
Unaffected: 0 , < 3.14 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74540",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:59:42.755795Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:54.604Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "15d6c2367217a6a20b1abae9f38ded716bf620f1",
"status": "affected",
"version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
"versionType": "git"
},
{
"lessThan": "1818180fe12d6cec7a437bc59cde8efdf6b10250",
"status": "affected",
"version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
"versionType": "git"
},
{
"lessThan": "8325eafb38c3dee5af329266393763693d17381b",
"status": "affected",
"version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
"versionType": "git"
},
{
"lessThan": "fd4c1e301bdec60a40728ea37de531cbccda501a",
"status": "affected",
"version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
"versionType": "git"
},
{
"lessThan": "522b730c62c53a1981604fd73524697fd347830d",
"status": "affected",
"version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
"versionType": "git"
},
{
"lessThan": "58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136",
"status": "affected",
"version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
"versionType": "git"
},
{
"lessThan": "09f447accc2570751e7d17f0dc0788b40d3edade",
"status": "affected",
"version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
"versionType": "git"
},
{
"lessThan": "c4740e7f23ff9a8210198d8b4703259e21b9f69d",
"status": "affected",
"version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.14"
},
{
"lessThan": "3.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp\n\nl2cap_le_connect_rsp() obtains a channel via\n__l2cap_get_chan_by_ident() but neither holds a reference nor uses\nl2cap_chan_hold_unless_zero() before locking and operating on it.\nA concurrent l2cap_chan_del() triggered by a remote disconnect can\nfree the channel between the lookup and l2cap_chan_lock(), causing\na use-after-free.\n\nThe BR/EDR counterpart l2cap_connect_rsp() and the sibling handler\nl2cap_le_command_rej() already use l2cap_chan_hold_unless_zero()\nto safely hold a reference, but l2cap_le_connect_rsp() was left\nunprotected.\n\nFix by adding l2cap_chan_hold_unless_zero() after the ident lookup\nand l2cap_chan_put() on the exit path, consistent with other L2CAP\nresponse handlers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerability is reached when the kernel processes an incoming L2CAP LE Connect Response over an established Bluetooth LE ACL link (HCI ACL receive \u2192 l2cap_recv_acldata \u2192 l2cap_le_sig_channel \u2192 l2cap_le_connect_rsp), requiring radio proximity rather than routable Internet access.\nAC:L - The remote Bluetooth peer controls both sides of the race by sending L2CAP_LE_CONN_RSP while concurrently triggering channel teardown via L2CAP DISCONN_REQ or HCI disconnect, freeing the channel between __l2cap_get_chan_by_ident() and l2cap_chan_lock() without attacker-uncontrollable timing.\nPR:N - No local privileges on the victim are required; exploitation needs only a nearby attacker with an established LE Bluetooth connection sending crafted L2CAP signaling packets, with no root, CAP_NET_ADMIN, or user-namespace capability on the target host.\nUI:N - On phones, wearables, automotive, and IoT deployments, paired or background Bluetooth clients routinely auto-initiate L2CAP credit-based connections without per-attack user confirmation once an LE link is up, enabling trigger of the pending outgoing connect path.\nS:U - Impact is confined to kernel memory and privileges on the Bluetooth-connected host; there is no VM guest-to-host escape, sandbox breakout, or IOMMU/DMA boundary crossing, so security scope remains unchanged per kernel CVSS guidance.\nC:H - Use-after-free of heap-allocated struct l2cap_chan allows attacker-controlled reuse of freed slab memory, enabling disclosure of kernel heap contents and pointers through corrupted channel fields accessed after premature free.\nI:H - The UAF window writes channel state (ident, dcid, mtu, credits) and invokes chan-\u003eops function pointers (ready, teardown) on freed memory, enabling heap spraying and control-flow hijack for arbitrary kernel code execution.\nA:H - Operating on a freed l2cap_chan can immediately kernel-oops or panic from corrupt mutex/state during lock/unlock and callback dispatch; UAF in softirq L2CAP processing inherently threatens full system availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:38:32.306Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/15d6c2367217a6a20b1abae9f38ded716bf620f1"
},
{
"url": "https://git.kernel.org/stable/c/1818180fe12d6cec7a437bc59cde8efdf6b10250"
},
{
"url": "https://git.kernel.org/stable/c/8325eafb38c3dee5af329266393763693d17381b"
},
{
"url": "https://git.kernel.org/stable/c/fd4c1e301bdec60a40728ea37de531cbccda501a"
},
{
"url": "https://git.kernel.org/stable/c/522b730c62c53a1981604fd73524697fd347830d"
},
{
"url": "https://git.kernel.org/stable/c/58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136"
},
{
"url": "https://git.kernel.org/stable/c/09f447accc2570751e7d17f0dc0788b40d3edade"
},
{
"url": "https://git.kernel.org/stable/c/c4740e7f23ff9a8210198d8b4703259e21b9f69d"
}
],
"title": "Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74540",
"datePublished": "2026-08-15T12:27:51.522Z",
"dateReserved": "2026-08-15T05:44:03.913Z",
"dateUpdated": "2026-10-16T19:05:54.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74540",
"date": "2026-10-31",
"epss": "0.00255",
"percentile": "0.17144"
},
"microsoft_vex": {
"current_release_date": "2026-09-25T02:17:46.000Z",
"cve": "CVE-2026-74540",
"id": "msrc_CVE-2026-74540",
"initial_release_date": "2026-08-23T15:01:24.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74540.json",
"version": "3"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "15d6c2367217a6a20b1abae9f38ded716bf620f1",
"status": "affected",
"version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
"versionType": "git"
},
{
"lessThan": "1818180fe12d6cec7a437bc59cde8efdf6b10250",
"status": "affected",
"version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
"versionType": "git"
},
{
"lessThan": "8325eafb38c3dee5af329266393763693d17381b",
"status": "affected",
"version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
"versionType": "git"
},
{
"lessThan": "fd4c1e301bdec60a40728ea37de531cbccda501a",
"status": "affected",
"version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
"versionType": "git"
},
{
"lessThan": "522b730c62c53a1981604fd73524697fd347830d",
"status": "affected",
"version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
"versionType": "git"
},
{
"lessThan": "58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136",
"status": "affected",
"version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
"versionType": "git"
},
{
"lessThan": "09f447accc2570751e7d17f0dc0788b40d3edade",
"status": "affected",
"version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
"versionType": "git"
},
{
"lessThan": "c4740e7f23ff9a8210198d8b4703259e21b9f69d",
"status": "affected",
"version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.14"
},
{
"lessThan": "3.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp\n\nl2cap_le_connect_rsp() obtains a channel via\n__l2cap_get_chan_by_ident() but neither holds a reference nor uses\nl2cap_chan_hold_unless_zero() before locking and operating on it.\nA concurrent l2cap_chan_del() triggered by a remote disconnect can\nfree the channel between the lookup and l2cap_chan_lock(), causing\na use-after-free.\n\nThe BR/EDR counterpart l2cap_connect_rsp() and the sibling handler\nl2cap_le_command_rej() already use l2cap_chan_hold_unless_zero()\nto safely hold a reference, but l2cap_le_connect_rsp() was left\nunprotected.\n\nFix by adding l2cap_chan_hold_unless_zero() after the ident lookup\nand l2cap_chan_put() on the exit path, consistent with other L2CAP\nresponse handlers."
}
],
"id": "CVE-2026-74540",
"lastModified": "2026-10-16T20:17:36.427",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-74540",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:59:42.755795Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-15T13:17:59.337",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/09f447accc2570751e7d17f0dc0788b40d3edade"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/15d6c2367217a6a20b1abae9f38ded716bf620f1"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/1818180fe12d6cec7a437bc59cde8efdf6b10250"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/522b730c62c53a1981604fd73524697fd347830d"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/8325eafb38c3dee5af329266393763693d17381b"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/c4740e7f23ff9a8210198d8b4703259e21b9f69d"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/fd4c1e301bdec60a40728ea37de531cbccda501a"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-10-17T21:25:18+00:00",
"cve": "CVE-2026-74540",
"id": "CVE-2026-74540",
"initial_release_date": "2026-08-15T00:00:00+00:00",
"product_status:known_affected": "233",
"product_status:known_not_affected": "42",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74540.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.