CVE-2026-74579 (GCVE-0-2026-74579)
Vulnerability from cvelistv5 – Published: 2026-08-17 05:28 – Updated: 2026-10-16 19:05
VLAI
EPSS
VEX
Title
netfilter: nft_payload: fix mask build for partial field offload
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_payload: fix mask build for partial field offload
nft_payload_offload_mask() builds the offload match mask for a payload
expression that covers only part of a header field. For a partial IPv6
address match (field_len = 16, priv_len = 1) that shift is 1 << 120, which
is undefined on the 32-bit int operand. It also trims only one word, so
the remaining words stay 0xffffffff (and when priv_len is a multiple of 4
the trim is skipped entirely), leaving the mask covering more bytes than
the rule matches.
UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20
shift exponent 120 is too large for 32-bit type 'int'
...
The match is byte-granular and struct nft_data is zero-initialised, so the
correct mask is simply the first priv_len bytes set to 0xff. Set those
bytes directly and drop the word/shift trimming; this removes the undefined
shift and no longer over-masks the trailing bytes.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:01 UTC
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 3ee7b3f813b11f28cd6efdf7f24d64b5a7fd4dc7
(git)
Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 8720df4504e0ed1781a702f65251bd47b3534d5e (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 363c3a84a946d53e5e121c9f47c7c2b7d228c46b (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < b19b5d2e042c294e2cc1c908dc598f9d64015396 (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < a375d8ace807767f29f276b681b6324c74929b1d (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 16b553c46e347bc9de9946c4960654d5884a86de (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 630295d5bba1d0e0f494cc459452eb0a0058c545 (git) Affected: a5d45bc0dc50f9dd83703510e9804d813a9cac32 , < 39e88f28fb32bf02bd4b525c24c842c9cff5663d (git) Affected: 5c2b4b4f9fa5b765b927e361e3d310bcb5773015 (git) Affected: 5.9.14 , < 5.10 (semver) |
guessed | |
| Linux | Linux |
Affected:
5.10
Unaffected: 0 , < 5.10 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74579",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:01:02.815654Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:57.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_payload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3ee7b3f813b11f28cd6efdf7f24d64b5a7fd4dc7",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "8720df4504e0ed1781a702f65251bd47b3534d5e",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "363c3a84a946d53e5e121c9f47c7c2b7d228c46b",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "b19b5d2e042c294e2cc1c908dc598f9d64015396",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "a375d8ace807767f29f276b681b6324c74929b1d",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "16b553c46e347bc9de9946c4960654d5884a86de",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "630295d5bba1d0e0f494cc459452eb0a0058c545",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "39e88f28fb32bf02bd4b525c24c842c9cff5663d",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"status": "affected",
"version": "5c2b4b4f9fa5b765b927e361e3d310bcb5773015",
"versionType": "git"
},
{
"lessThan": "5.10",
"status": "affected",
"version": "5.9.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_payload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.9.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_payload: fix mask build for partial field offload\n\nnft_payload_offload_mask() builds the offload match mask for a payload\nexpression that covers only part of a header field. For a partial IPv6\naddress match (field_len = 16, priv_len = 1) that shift is 1 \u003c\u003c 120, which\nis undefined on the 32-bit int operand. It also trims only one word, so\nthe remaining words stay 0xffffffff (and when priv_len is a multiple of 4\nthe trim is skipped entirely), leaving the mask covering more bytes than\nthe rule matches.\n\n UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20\n shift exponent 120 is too large for 32-bit type \u0027int\u0027\n ...\n\nThe match is byte-granular and struct nft_data is zero-initialised, so the\ncorrect mask is simply the first priv_len bytes set to 0xff. Set those\nbytes directly and drop the word/shift trimming; this removes the undefined\nshift and no longer over-masks the trailing bytes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only when installing nftables rules via NETLINK_NETFILTER (NFT_MSG_NEWRULE) on NFT_CHAIN_HW_OFFLOAD netdev ingress chains; nft_flow_rule_create() calls nft_payload_offload_mask() during expr offload setup, which is a local netlink syscall path per kernel CNA guidance for nftables/netfilter.\nAC:L - An attacker with CAP_NET_ADMIN can deterministically craft a partial-field payload match (e.g., priv_len=1 on IPv6 saddr with field_len=16) on an HW-offload chain; no race, memory layout, or other conditions outside attacker control are required to hit the undefined shift and incorrect mask build.\nPR:L - All nf_tables netlink operations are gated by netlink_net_capable(skb, CAP_NET_ADMIN) in nfnetlink_rcv(), checked against the socket network namespace user_ns; unprivileged local users routinely obtain CAP_NET_ADMIN via user+network namespaces (unshare -Urn) on cloud hosts and containers.\nUI:N - No victim interaction is required; the attacker installs the malformed HW-offload nftables rule through their own netlink socket and triggers the bug during rule commit without needing another user to mount filesystems, open files, or take any action.\nS:U - Impact is confined to the host kernel and its hardware-offloaded netdev ingress filtering policy (incorrect TC flower masks, potential kernel crash); this is standard kernel/network-authority impact, not a VM escape, IOMMU bypass, or cross-security-boundary scope change.\nC:N - The bug corrupts on-stack bitmask construction during rule installation and does not perform out-of-bounds reads, use-after-free, or other memory-disclosure primitives; no attacker-influenced kernel memory read path exists beyond incorrect mask values.\nI:H - Incorrect or UB-corrupted HW flower match masks misprogram NIC ingress ACLs on hardware-offloaded edge firewalls, causing accept/drop/redirect actions to apply to traffic contrary to administrator intent; this is exploitable integrity compromise of enforced network policy on internet-facing offload deployments.\nA:H - The undefined shift (1\u003c\u003c120) triggers documented UBSAN shift-out-of-bounds at rule install and can panic/oops on UBSAN/trap kernels; misprogrammed HW offload masks can also blackhole or mis-drop production ingress traffic on netdev-offloaded chains, satisfying CNA high availability guidance."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:05.144Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3ee7b3f813b11f28cd6efdf7f24d64b5a7fd4dc7"
},
{
"url": "https://git.kernel.org/stable/c/8720df4504e0ed1781a702f65251bd47b3534d5e"
},
{
"url": "https://git.kernel.org/stable/c/363c3a84a946d53e5e121c9f47c7c2b7d228c46b"
},
{
"url": "https://git.kernel.org/stable/c/b19b5d2e042c294e2cc1c908dc598f9d64015396"
},
{
"url": "https://git.kernel.org/stable/c/a375d8ace807767f29f276b681b6324c74929b1d"
},
{
"url": "https://git.kernel.org/stable/c/16b553c46e347bc9de9946c4960654d5884a86de"
},
{
"url": "https://git.kernel.org/stable/c/630295d5bba1d0e0f494cc459452eb0a0058c545"
},
{
"url": "https://git.kernel.org/stable/c/39e88f28fb32bf02bd4b525c24c842c9cff5663d"
}
],
"title": "netfilter: nft_payload: fix mask build for partial field offload",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74579",
"datePublished": "2026-08-17T05:28:27.768Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-10-16T19:05:57.728Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74579",
"date": "2026-11-02",
"epss": "0.0012",
"percentile": "0.01819"
},
"microsoft_vex": {
"current_release_date": "2026-09-25T02:29:17.000Z",
"cve": "CVE-2026-74579",
"id": "msrc_CVE-2026-74579",
"initial_release_date": "2026-08-20T21:58:42.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "netfilter: nft_payload: fix mask build for partial field offload",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74579.json",
"version": "4"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_payload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3ee7b3f813b11f28cd6efdf7f24d64b5a7fd4dc7",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "8720df4504e0ed1781a702f65251bd47b3534d5e",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "363c3a84a946d53e5e121c9f47c7c2b7d228c46b",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "b19b5d2e042c294e2cc1c908dc598f9d64015396",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "a375d8ace807767f29f276b681b6324c74929b1d",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "16b553c46e347bc9de9946c4960654d5884a86de",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "630295d5bba1d0e0f494cc459452eb0a0058c545",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"lessThan": "39e88f28fb32bf02bd4b525c24c842c9cff5663d",
"status": "affected",
"version": "a5d45bc0dc50f9dd83703510e9804d813a9cac32",
"versionType": "git"
},
{
"status": "affected",
"version": "5c2b4b4f9fa5b765b927e361e3d310bcb5773015",
"versionType": "git"
},
{
"lessThan": "5.10",
"status": "affected",
"version": "5.9.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_payload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_payload: fix mask build for partial field offload\n\nnft_payload_offload_mask() builds the offload match mask for a payload\nexpression that covers only part of a header field. For a partial IPv6\naddress match (field_len = 16, priv_len = 1) that shift is 1 \u003c\u003c 120, which\nis undefined on the 32-bit int operand. It also trims only one word, so\nthe remaining words stay 0xffffffff (and when priv_len is a multiple of 4\nthe trim is skipped entirely), leaving the mask covering more bytes than\nthe rule matches.\n\n UBSAN: shift-out-of-bounds in net/netfilter/nft_payload.c:278:20\n shift exponent 120 is too large for 32-bit type \u0027int\u0027\n ...\n\nThe match is byte-granular and struct nft_data is zero-initialised, so the\ncorrect mask is simply the first priv_len bytes set to 0xff. Set those\nbytes directly and drop the word/shift trimming; this removes the undefined\nshift and no longer over-masks the trailing bytes."
}
],
"id": "CVE-2026-74579",
"lastModified": "2026-10-16T20:17:39.580",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-74579",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:01:02.815654Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-17T06:19:56.417",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/16b553c46e347bc9de9946c4960654d5884a86de"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/363c3a84a946d53e5e121c9f47c7c2b7d228c46b"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/39e88f28fb32bf02bd4b525c24c842c9cff5663d"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/3ee7b3f813b11f28cd6efdf7f24d64b5a7fd4dc7"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/630295d5bba1d0e0f494cc459452eb0a0058c545"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/8720df4504e0ed1781a702f65251bd47b3534d5e"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a375d8ace807767f29f276b681b6324c74929b1d"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/b19b5d2e042c294e2cc1c908dc598f9d64015396"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Low",
"current_release_date": "2026-08-25T10:02:53+00:00",
"cve": "CVE-2026-74579",
"id": "CVE-2026-74579",
"initial_release_date": "2026-08-17T00:00:00+00:00",
"product_status:known_affected": "232",
"product_status:known_not_affected": "42",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: netfilter: nft_payload: fix mask build for partial field offload",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74579.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.