CVE-2026-74717 (GCVE-0-2026-74717)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-10-16 19:16
VLAI
EPSS
VEX
Title
net/mlx5: fw_tracer, return NULL on create error
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: fw_tracer, return NULL on create error
Tracer creation can fail by returning either NULL or ERR_PTR.
The return value is stored without a check on the device, and users
treat ERR_PTR and NULL the same way.
This also causes a crash in the core dump logic, which is missing the
ERR_PTR check and ends up dereferencing it, as shown in the trace below.
Switch tracer creation to return NULL on failure only, so callers only
need a single NULL check.
Internal error: Oops: 0000000096000006 [#1] SMP
Modules linked in: mlx5_ib ib_uverbs ib_core ipv6 mlx5_core
CPU: 1 UID: 0 PID: 12 Comm: kworker/u16:0 Not tainted 6.19.7 #1 PREEMPT(none)
Workqueue: mlx5_health0001:01:00.0 mlx5_fw_reporter_err_work [mlx5_core]
pstate: a3400009 (NzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core]
lr : mlx5_fw_tracer_trigger_core_dump_general+0x40/0xe0 [mlx5_core]
sp : ffff800081cf3c40
x29: ffff800081cf3c90 x28: 0000000000000000 x27: 0000000000000000
x26: ffff000080018828 x25: 0000000000000000 x24: ffff000080304a05
x23: ffff800081cf3d80 x22: ffff0000847e01a0 x21: 0000000000000000
x20: ffff0000847e01a0 x19: ffffffffffffffa1 x18: ffff80008310bbf0
x17: ffff800080119650 x16: ffff80008010df54 x15: ffff80008010d4ac
x14: ffff800079c202e4 x13: ffff80008002fe60 x12: ffff800080119650
x11: ffff80008010df54 x10: ffff80008010d4ac x9 : ffff800079c203d8
x8 : ffff800081cf3c88 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000030
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 00000000c5c4000e
Call trace:
mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] (P)
mlx5_fw_reporter_dump+0x30/0x2e0 [mlx5_core]
devlink_health_do_dump+0x9c/0x160
devlink_health_report+0x1c0/0x288
mlx5_fw_reporter_err_work+0xac/0xc0 [mlx5_core]
process_one_work+0x15c/0x3d8
worker_thread+0x18c/0x320
kthread+0x148/0x228
ret_from_fork+0x10/0x20
Code: b9400000 5ac00800 7a401800 540003ca (3940a260)
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Oops: Fatal exception
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x000000,00078031,75fce5a1,35fffe67
Memory Limit: none
---[ end Kernel panic - not syncing: Oops: Fatal exception ]---
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:15 UTC
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
fd1483fe1f9fd45fe312adffb0faffa57446690d , < 47fe0d2571e5b446a0f0b0c1d6b99f55e51f5cc0
(git)
Affected: fd1483fe1f9fd45fe312adffb0faffa57446690d , < ee41ea49c4ab0e4015919f52ad23ec251d3b39d3 (git) Affected: fd1483fe1f9fd45fe312adffb0faffa57446690d , < 04599570c3a18f9ae7aad36825eb46f3dcd2c4e3 (git) Affected: fd1483fe1f9fd45fe312adffb0faffa57446690d , < 9a416f000285a94c1b723877547981dec8132434 (git) Affected: fd1483fe1f9fd45fe312adffb0faffa57446690d , < b1d6375b9a63c9dc7e5e780d3ea9b126fe30d6cb (git) Affected: fd1483fe1f9fd45fe312adffb0faffa57446690d , < 80094352bd40ba54a33731f9c22872493983ed6d (git) Affected: fd1483fe1f9fd45fe312adffb0faffa57446690d , < 4aafa600d93e9551c1f24e785d57cbd4adf021d5 (git) Affected: fd1483fe1f9fd45fe312adffb0faffa57446690d , < af39eb111ce6b5eba9c08513b62c4868eb7e7fd5 (git) |
guessed | |
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74717",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:15:32.943854Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:16:11.661Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "47fe0d2571e5b446a0f0b0c1d6b99f55e51f5cc0",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "ee41ea49c4ab0e4015919f52ad23ec251d3b39d3",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "04599570c3a18f9ae7aad36825eb46f3dcd2c4e3",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "9a416f000285a94c1b723877547981dec8132434",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "b1d6375b9a63c9dc7e5e780d3ea9b126fe30d6cb",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "80094352bd40ba54a33731f9c22872493983ed6d",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "4aafa600d93e9551c1f24e785d57cbd4adf021d5",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "af39eb111ce6b5eba9c08513b62c4868eb7e7fd5",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fw_tracer, return NULL on create error\n\nTracer creation can fail by returning either NULL or ERR_PTR.\nThe return value is stored without a check on the device, and users\ntreat ERR_PTR and NULL the same way.\nThis also causes a crash in the core dump logic, which is missing the\nERR_PTR check and ends up dereferencing it, as shown in the trace below.\n\nSwitch tracer creation to return NULL on failure only, so callers only\nneed a single NULL check.\n\n Internal error: Oops: 0000000096000006 [#1] SMP\n Modules linked in: mlx5_ib ib_uverbs ib_core ipv6 mlx5_core\n CPU: 1 UID: 0 PID: 12 Comm: kworker/u16:0 Not tainted 6.19.7 #1 PREEMPT(none)\n Workqueue: mlx5_health0001:01:00.0 mlx5_fw_reporter_err_work [mlx5_core]\n pstate: a3400009 (NzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core]\n lr : mlx5_fw_tracer_trigger_core_dump_general+0x40/0xe0 [mlx5_core]\n sp : ffff800081cf3c40\n x29: ffff800081cf3c90 x28: 0000000000000000 x27: 0000000000000000\n x26: ffff000080018828 x25: 0000000000000000 x24: ffff000080304a05\n x23: ffff800081cf3d80 x22: ffff0000847e01a0 x21: 0000000000000000\n x20: ffff0000847e01a0 x19: ffffffffffffffa1 x18: ffff80008310bbf0\n x17: ffff800080119650 x16: ffff80008010df54 x15: ffff80008010d4ac\n x14: ffff800079c202e4 x13: ffff80008002fe60 x12: ffff800080119650\n x11: ffff80008010df54 x10: ffff80008010d4ac x9 : ffff800079c203d8\n x8 : ffff800081cf3c88 x7 : 0000000000000000 x6 : 0000000000000000\n x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000030\n x2 : 0000000000000008 x1 : 0000000000000000 x0 : 00000000c5c4000e\n Call trace:\n mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] (P)\n mlx5_fw_reporter_dump+0x30/0x2e0 [mlx5_core]\n devlink_health_do_dump+0x9c/0x160\n devlink_health_report+0x1c0/0x288\n mlx5_fw_reporter_err_work+0xac/0xc0 [mlx5_core]\n process_one_work+0x15c/0x3d8\n worker_thread+0x18c/0x320\n kthread+0x148/0x228\n ret_from_fork+0x10/0x20\n Code: b9400000 5ac00800 7a401800 540003ca (3940a260)\n ---[ end trace 0000000000000000 ]---\n Kernel panic - not syncing: Oops: Fatal exception\n SMP: stopping secondary CPUs\n Kernel Offset: disabled\n CPU features: 0x000000,00078031,75fce5a1,35fffe67\n Memory Limit: none\n ---[ end Kernel panic - not syncing: Oops: Fatal exception ]---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On internet-facing cloud/HPC hosts with mlx5 PF NICs, a remote attacker can induce ConnectX firmware syndrome via crafted network/RDMA traffic; the kernel health poller then auto-invokes mlx5_fw_reporter_dump without any local syscall.\nAC:L - On affected hardware, mlx5_fw_tracer_create leaves ERR_PTR in dev-\u003etracer at probe (e.g. -EOPNOTSUPP when trace_to_memory is unset); once present, any FW syndrome or health miss counter event reliably queues the dump workqueue that dereferences the bad pointer.\nPR:N - The crash path shown in the fix oops is triggered automatically by mlx5_fw_reporter_err_work from the health poller with no userspace action; inducing FW syndrome over the network requires no host credentials, unlike the optional devlink dump path that needs CAP_NET_ADMIN.\nUI:N - Exploitation requires no victim interaction; the devlink health auto_dump fires from kernel workqueues when firmware reports a syndrome or miss-count threshold, independent of user actions such as mounts or file opens.\nS:U - Impact is confined to kernel crash/panic on the host running mlx5_core; there is no VM escape, IOMMU bypass, or crossing from guest VF context into a separate security authority beyond standard host kernel failure.\nC:N - The bug is an ERR_PTR mishandled as a valid mlx5_fw_tracer pointer; mlx5_fw_tracer_trigger_core_dump_general dereferences tracer-\u003eowner and faults immediately, producing an oops with no out-of-bounds read, UAF, or information disclosure primitive.\nI:N - Faulting on an ERR_PTR-encoded address does not corrupt adjacent memory or provide a controllable write primitive; the only outcome is an unrecoverable kernel oops/panic, not arbitrary modification or code execution.\nA:H - The fix commit documents a fatal kernel Oops in mlx5_fw_tracer_trigger_core_dump_general followed by \u0027Kernel panic - not syncing\u0027, causing complete loss of host availability on affected mlx5 PF systems when the FW reporter dump path runs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:59.788Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/47fe0d2571e5b446a0f0b0c1d6b99f55e51f5cc0"
},
{
"url": "https://git.kernel.org/stable/c/ee41ea49c4ab0e4015919f52ad23ec251d3b39d3"
},
{
"url": "https://git.kernel.org/stable/c/04599570c3a18f9ae7aad36825eb46f3dcd2c4e3"
},
{
"url": "https://git.kernel.org/stable/c/9a416f000285a94c1b723877547981dec8132434"
},
{
"url": "https://git.kernel.org/stable/c/b1d6375b9a63c9dc7e5e780d3ea9b126fe30d6cb"
},
{
"url": "https://git.kernel.org/stable/c/80094352bd40ba54a33731f9c22872493983ed6d"
},
{
"url": "https://git.kernel.org/stable/c/4aafa600d93e9551c1f24e785d57cbd4adf021d5"
},
{
"url": "https://git.kernel.org/stable/c/af39eb111ce6b5eba9c08513b62c4868eb7e7fd5"
}
],
"title": "net/mlx5: fw_tracer, return NULL on create error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74717",
"datePublished": "2026-08-22T15:33:11.488Z",
"dateReserved": "2026-08-15T05:44:03.928Z",
"dateUpdated": "2026-10-16T19:16:11.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74717",
"date": "2026-10-16",
"epss": "0.00501",
"percentile": "0.41549"
},
"microsoft_vex": {
"current_release_date": "2026-09-25T01:54:13.000Z",
"cve": "CVE-2026-74717",
"id": "msrc_CVE-2026-74717",
"initial_release_date": "2026-08-24T01:04:01.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "net/mlx5: fw_tracer, return NULL on create error",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74717.json",
"version": "4"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "47fe0d2571e5b446a0f0b0c1d6b99f55e51f5cc0",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "ee41ea49c4ab0e4015919f52ad23ec251d3b39d3",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "04599570c3a18f9ae7aad36825eb46f3dcd2c4e3",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "9a416f000285a94c1b723877547981dec8132434",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "b1d6375b9a63c9dc7e5e780d3ea9b126fe30d6cb",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "80094352bd40ba54a33731f9c22872493983ed6d",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "4aafa600d93e9551c1f24e785d57cbd4adf021d5",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "af39eb111ce6b5eba9c08513b62c4868eb7e7fd5",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fw_tracer, return NULL on create error\n\nTracer creation can fail by returning either NULL or ERR_PTR.\nThe return value is stored without a check on the device, and users\ntreat ERR_PTR and NULL the same way.\nThis also causes a crash in the core dump logic, which is missing the\nERR_PTR check and ends up dereferencing it, as shown in the trace below.\n\nSwitch tracer creation to return NULL on failure only, so callers only\nneed a single NULL check.\n\n Internal error: Oops: 0000000096000006 [#1] SMP\n Modules linked in: mlx5_ib ib_uverbs ib_core ipv6 mlx5_core\n CPU: 1 UID: 0 PID: 12 Comm: kworker/u16:0 Not tainted 6.19.7 #1 PREEMPT(none)\n Workqueue: mlx5_health0001:01:00.0 mlx5_fw_reporter_err_work [mlx5_core]\n pstate: a3400009 (NzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core]\n lr : mlx5_fw_tracer_trigger_core_dump_general+0x40/0xe0 [mlx5_core]\n sp : ffff800081cf3c40\n x29: ffff800081cf3c90 x28: 0000000000000000 x27: 0000000000000000\n x26: ffff000080018828 x25: 0000000000000000 x24: ffff000080304a05\n x23: ffff800081cf3d80 x22: ffff0000847e01a0 x21: 0000000000000000\n x20: ffff0000847e01a0 x19: ffffffffffffffa1 x18: ffff80008310bbf0\n x17: ffff800080119650 x16: ffff80008010df54 x15: ffff80008010d4ac\n x14: ffff800079c202e4 x13: ffff80008002fe60 x12: ffff800080119650\n x11: ffff80008010df54 x10: ffff80008010d4ac x9 : ffff800079c203d8\n x8 : ffff800081cf3c88 x7 : 0000000000000000 x6 : 0000000000000000\n x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000030\n x2 : 0000000000000008 x1 : 0000000000000000 x0 : 00000000c5c4000e\n Call trace:\n mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] (P)\n mlx5_fw_reporter_dump+0x30/0x2e0 [mlx5_core]\n devlink_health_do_dump+0x9c/0x160\n devlink_health_report+0x1c0/0x288\n mlx5_fw_reporter_err_work+0xac/0xc0 [mlx5_core]\n process_one_work+0x15c/0x3d8\n worker_thread+0x18c/0x320\n kthread+0x148/0x228\n ret_from_fork+0x10/0x20\n Code: b9400000 5ac00800 7a401800 540003ca (3940a260)\n ---[ end trace 0000000000000000 ]---\n Kernel panic - not syncing: Oops: Fatal exception\n SMP: stopping secondary CPUs\n Kernel Offset: disabled\n CPU features: 0x000000,00078031,75fce5a1,35fffe67\n Memory Limit: none\n ---[ end Kernel panic - not syncing: Oops: Fatal exception ]---"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nnet/mlx5: fw_tracer, devuelve NULL en error de creaci\u00f3n\n\nLa creaci\u00f3n del tracer puede fallar devolviendo NULL o ERR_PTR.\nEl valor de retorno se almacena sin una verificaci\u00f3n en el dispositivo, y los usuarios tratan ERR_PTR y NULL de la misma manera.\nEsto tambi\u00e9n causa un fallo en la l\u00f3gica de volcado de memoria (core dump), que carece de la verificaci\u00f3n de ERR_PTR y termina desreferenci\u00e1ndolo, como se muestra en el rastreo a continuaci\u00f3n.\n\nCambiar la creaci\u00f3n del tracer para que devuelva NULL solo en caso de fallo, de modo que los llamadores solo necesiten una \u00fanica verificaci\u00f3n de NULL.\n\n Error interno: Oops: 0000000096000006 [#1] SMP\n M\u00f3dulos enlazados: mlx5_ib ib_uverbs ib_core ipv6 mlx5_core\n CPU: 1 UID: 0 PID: 12 Comm: kworker/u16:0 No contaminado 6.19.7 #1 PREEMPT(none)\n Cola de trabajo: mlx5_health0001:01:00.0 mlx5_fw_reporter_err_work [mlx5_core]\n pstate: a3400009 (NzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core]\n lr : mlx5_fw_tracer_trigger_core_dump_general+0x40/0xe0 [mlx5_core]\n sp : ffff800081cf3c40\n x29: ffff800081cf3c90 x28: 0000000000000000 x27: 0000000000000000\n x26: ffff000080018828 x25: 0000000000000000 x24: ffff000080304a05\n x23: ffff800081cf3d80 x22: ffff0000847e01a0 x21: 0000000000000000\n x20: ffff0000847e01a0 x19: ffffffffffffffa1 x18: ffff80008310bbf0\n x17: ffff800080119650 x16: ffff80008010df54 x15: ffff80008010d4ac\n x14: ffff800079c202e4 x13: ffff80008002fe60 x12: ffff800080119650\n x11: ffff80008010df54 x10: ffff80008010d4ac x9 : ffff800079c203d8\n x8 : ffff800081cf3c88 x7 : 0000000000000000 x6 : 0000000000000000\n x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000030\n x2 : 0000000000000008 x1 : 0000000000000000 x0 : 00000000c5c4000e\n Rastreo de llamadas:\n mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] (P)\n mlx5_fw_reporter_dump+0x30/0x2e0 [mlx5_core]\n devlink_health_do_dump+0x9c/0x160\n devlink_health_report+0x1c0/0x288\n mlx5_fw_reporter_err_work+0xac/0xc0 [mlx5_core]\n process_one_work+0x15c/0x3d8\n worker_thread+0x18c/0x320\n kthread+0x148/0x228\n ret_from_fork+0x10/0x20\n C\u00f3digo: b9400000 5ac00800 7a401800 540003ca (3940a260)\n ---[ fin del rastreo 0000000000000000 ]---\n P\u00e1nico del kernel - no sincronizando: Oops: Excepci\u00f3n fatal\n SMP: deteniendo CPUs secundarias\n Desplazamiento del kernel: deshabilitado\n Caracter\u00edsticas de la CPU: 0x000000,00078031,75fce5a1,35fffe67\n L\u00edmite de memoria: ninguno\n ---[ fin del P\u00e1nico del kernel - no sincronizando: Oops: Excepci\u00f3n fatal ]---"
}
],
"id": "CVE-2026-74717",
"lastModified": "2026-10-16T20:17:54.363",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-74717",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:15:32.943854Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-22T16:16:46.570",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/04599570c3a18f9ae7aad36825eb46f3dcd2c4e3"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/47fe0d2571e5b446a0f0b0c1d6b99f55e51f5cc0"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/4aafa600d93e9551c1f24e785d57cbd4adf021d5"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/80094352bd40ba54a33731f9c22872493983ed6d"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/9a416f000285a94c1b723877547981dec8132434"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/af39eb111ce6b5eba9c08513b62c4868eb7e7fd5"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/b1d6375b9a63c9dc7e5e780d3ea9b126fe30d6cb"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/ee41ea49c4ab0e4015919f52ad23ec251d3b39d3"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Low",
"current_release_date": "2026-08-25T10:02:56+00:00",
"cve": "CVE-2026-74717",
"id": "CVE-2026-74717",
"initial_release_date": "2026-08-22T00:00:00+00:00",
"product_status:known_affected": "246",
"product_status:known_not_affected": "28",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: net/mlx5: fw_tracer, return NULL on create error",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74717.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74717",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:15:32.943854Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:15:33.512Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "47fe0d2571e5b446a0f0b0c1d6b99f55e51f5cc0",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "ee41ea49c4ab0e4015919f52ad23ec251d3b39d3",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "04599570c3a18f9ae7aad36825eb46f3dcd2c4e3",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "9a416f000285a94c1b723877547981dec8132434",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "b1d6375b9a63c9dc7e5e780d3ea9b126fe30d6cb",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "80094352bd40ba54a33731f9c22872493983ed6d",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "4aafa600d93e9551c1f24e785d57cbd4adf021d5",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
},
{
"lessThan": "af39eb111ce6b5eba9c08513b62c4868eb7e7fd5",
"status": "affected",
"version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fw_tracer, return NULL on create error\n\nTracer creation can fail by returning either NULL or ERR_PTR.\nThe return value is stored without a check on the device, and users\ntreat ERR_PTR and NULL the same way.\nThis also causes a crash in the core dump logic, which is missing the\nERR_PTR check and ends up dereferencing it, as shown in the trace below.\n\nSwitch tracer creation to return NULL on failure only, so callers only\nneed a single NULL check.\n\n Internal error: Oops: 0000000096000006 [#1] SMP\n Modules linked in: mlx5_ib ib_uverbs ib_core ipv6 mlx5_core\n CPU: 1 UID: 0 PID: 12 Comm: kworker/u16:0 Not tainted 6.19.7 #1 PREEMPT(none)\n Workqueue: mlx5_health0001:01:00.0 mlx5_fw_reporter_err_work [mlx5_core]\n pstate: a3400009 (NzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core]\n lr : mlx5_fw_tracer_trigger_core_dump_general+0x40/0xe0 [mlx5_core]\n sp : ffff800081cf3c40\n x29: ffff800081cf3c90 x28: 0000000000000000 x27: 0000000000000000\n x26: ffff000080018828 x25: 0000000000000000 x24: ffff000080304a05\n x23: ffff800081cf3d80 x22: ffff0000847e01a0 x21: 0000000000000000\n x20: ffff0000847e01a0 x19: ffffffffffffffa1 x18: ffff80008310bbf0\n x17: ffff800080119650 x16: ffff80008010df54 x15: ffff80008010d4ac\n x14: ffff800079c202e4 x13: ffff80008002fe60 x12: ffff800080119650\n x11: ffff80008010df54 x10: ffff80008010d4ac x9 : ffff800079c203d8\n x8 : ffff800081cf3c88 x7 : 0000000000000000 x6 : 0000000000000000\n x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000030\n x2 : 0000000000000008 x1 : 0000000000000000 x0 : 00000000c5c4000e\n Call trace:\n mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] (P)\n mlx5_fw_reporter_dump+0x30/0x2e0 [mlx5_core]\n devlink_health_do_dump+0x9c/0x160\n devlink_health_report+0x1c0/0x288\n mlx5_fw_reporter_err_work+0xac/0xc0 [mlx5_core]\n process_one_work+0x15c/0x3d8\n worker_thread+0x18c/0x320\n kthread+0x148/0x228\n ret_from_fork+0x10/0x20\n Code: b9400000 5ac00800 7a401800 540003ca (3940a260)\n ---[ end trace 0000000000000000 ]---\n Kernel panic - not syncing: Oops: Fatal exception\n SMP: stopping secondary CPUs\n Kernel Offset: disabled\n CPU features: 0x000000,00078031,75fce5a1,35fffe67\n Memory Limit: none\n ---[ end Kernel panic - not syncing: Oops: Fatal exception ]---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On internet-facing cloud/HPC hosts with mlx5 PF NICs, a remote attacker can induce ConnectX firmware syndrome via crafted network/RDMA traffic; the kernel health poller then auto-invokes mlx5_fw_reporter_dump without any local syscall.\nAC:L - On affected hardware, mlx5_fw_tracer_create leaves ERR_PTR in dev-\u003etracer at probe (e.g. -EOPNOTSUPP when trace_to_memory is unset); once present, any FW syndrome or health miss counter event reliably queues the dump workqueue that dereferences the bad pointer.\nPR:N - The crash path shown in the fix oops is triggered automatically by mlx5_fw_reporter_err_work from the health poller with no userspace action; inducing FW syndrome over the network requires no host credentials, unlike the optional devlink dump path that needs CAP_NET_ADMIN.\nUI:N - Exploitation requires no victim interaction; the devlink health auto_dump fires from kernel workqueues when firmware reports a syndrome or miss-count threshold, independent of user actions such as mounts or file opens.\nS:U - Impact is confined to kernel crash/panic on the host running mlx5_core; there is no VM escape, IOMMU bypass, or crossing from guest VF context into a separate security authority beyond standard host kernel failure.\nC:N - The bug is an ERR_PTR mishandled as a valid mlx5_fw_tracer pointer; mlx5_fw_tracer_trigger_core_dump_general dereferences tracer-\u003eowner and faults immediately, producing an oops with no out-of-bounds read, UAF, or information disclosure primitive.\nI:N - Faulting on an ERR_PTR-encoded address does not corrupt adjacent memory or provide a controllable write primitive; the only outcome is an unrecoverable kernel oops/panic, not arbitrary modification or code execution.\nA:H - The fix commit documents a fatal kernel Oops in mlx5_fw_tracer_trigger_core_dump_general followed by \u0027Kernel panic - not syncing\u0027, causing complete loss of host availability on affected mlx5 PF systems when the FW reporter dump path runs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:59.788Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/47fe0d2571e5b446a0f0b0c1d6b99f55e51f5cc0"
},
{
"url": "https://git.kernel.org/stable/c/ee41ea49c4ab0e4015919f52ad23ec251d3b39d3"
},
{
"url": "https://git.kernel.org/stable/c/04599570c3a18f9ae7aad36825eb46f3dcd2c4e3"
},
{
"url": "https://git.kernel.org/stable/c/9a416f000285a94c1b723877547981dec8132434"
},
{
"url": "https://git.kernel.org/stable/c/b1d6375b9a63c9dc7e5e780d3ea9b126fe30d6cb"
},
{
"url": "https://git.kernel.org/stable/c/80094352bd40ba54a33731f9c22872493983ed6d"
},
{
"url": "https://git.kernel.org/stable/c/4aafa600d93e9551c1f24e785d57cbd4adf021d5"
},
{
"url": "https://git.kernel.org/stable/c/af39eb111ce6b5eba9c08513b62c4868eb7e7fd5"
}
],
"title": "net/mlx5: fw_tracer, return NULL on create error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74717",
"datePublished": "2026-08-22T15:33:11.488Z",
"dateReserved": "2026-08-15T05:44:03.928Z",
"dateUpdated": "2026-10-16T19:16:11.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.