CVE-2026-89965 (GCVE-0-2026-89965)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:32 – Updated: 2026-09-16 14:40
VLAI
Title
nvdimm/btt: reject an arena whose nfree is below the lane count
Summary
In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: reject an arena whose nfree is below the lane count The BTT info block's nfree field, the number of reserve free blocks, is read from the medium without validation. btt_freelist_init() and btt_rtt_init() size the per-lane freelist[] and rtt[] arrays by nfree, but the I/O path indexes them by the lane from nd_region_acquire_lane(), which is bounded by nd_region->num_lanes (ND_MAX_LANES), not by nfree. A crafted or foreign arena whose nfree is below the lane count makes freelist[lane]/rtt[lane] run past the allocation: an out-of-bounds write. btt.rst documents the nlanes = min(nfree, num_cpus) invariant, which the code does not currently honor: num_lanes is ND_MAX_LANES regardless of nfree. Reject an arena whose nfree is below num_lanes at discovery, before the per-lane arrays are allocated, enforcing that invariant.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5212e11fde4d40fa627668b4f2222d20db488f71 , < eb491343d2d1784121ad9af91c25b338c28913c3 (git)
Affected: 5212e11fde4d40fa627668b4f2222d20db488f71 , < 59d5cd1f42b4bab3609512c3cb3d3540d3d21da7 (git)
Affected: 5212e11fde4d40fa627668b4f2222d20db488f71 , < f6c5313aae794ecca8f762c1a3493de5c266f120 (git)
Affected: 5212e11fde4d40fa627668b4f2222d20db488f71 , < f9bf05c63b77d000e9c01f3e47af36973887d350 (git)
Affected: 5212e11fde4d40fa627668b4f2222d20db488f71 , < 6f79d1a5f2611a3d36e9312be5425cd9cb397c51 (git)
Affected: 5212e11fde4d40fa627668b4f2222d20db488f71 , < 6b1faf1f099f7060b5f1f2f0d024132581f1726e (git)
Affected: 5212e11fde4d40fa627668b4f2222d20db488f71 , < 9dfa11cef4750b67591307f2c62e47a23d60e4b7 (git)
Affected: 5212e11fde4d40fa627668b4f2222d20db488f71 , < 6a1f2e5ed9267ca19187038ac635393c165213ac (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvdimm/btt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eb491343d2d1784121ad9af91c25b338c28913c3",
              "status": "affected",
              "version": "5212e11fde4d40fa627668b4f2222d20db488f71",
              "versionType": "git"
            },
            {
              "lessThan": "59d5cd1f42b4bab3609512c3cb3d3540d3d21da7",
              "status": "affected",
              "version": "5212e11fde4d40fa627668b4f2222d20db488f71",
              "versionType": "git"
            },
            {
              "lessThan": "f6c5313aae794ecca8f762c1a3493de5c266f120",
              "status": "affected",
              "version": "5212e11fde4d40fa627668b4f2222d20db488f71",
              "versionType": "git"
            },
            {
              "lessThan": "f9bf05c63b77d000e9c01f3e47af36973887d350",
              "status": "affected",
              "version": "5212e11fde4d40fa627668b4f2222d20db488f71",
              "versionType": "git"
            },
            {
              "lessThan": "6f79d1a5f2611a3d36e9312be5425cd9cb397c51",
              "status": "affected",
              "version": "5212e11fde4d40fa627668b4f2222d20db488f71",
              "versionType": "git"
            },
            {
              "lessThan": "6b1faf1f099f7060b5f1f2f0d024132581f1726e",
              "status": "affected",
              "version": "5212e11fde4d40fa627668b4f2222d20db488f71",
              "versionType": "git"
            },
            {
              "lessThan": "9dfa11cef4750b67591307f2c62e47a23d60e4b7",
              "status": "affected",
              "version": "5212e11fde4d40fa627668b4f2222d20db488f71",
              "versionType": "git"
            },
            {
              "lessThan": "6a1f2e5ed9267ca19187038ac635393c165213ac",
              "status": "affected",
              "version": "5212e11fde4d40fa627668b4f2222d20db488f71",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvdimm/btt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/btt: reject an arena whose nfree is below the lane count\n\nThe BTT info block\u0027s nfree field, the number of reserve free blocks, is\nread from the medium without validation.  btt_freelist_init() and\nbtt_rtt_init() size the per-lane freelist[] and rtt[] arrays by nfree,\nbut the I/O path indexes them by the lane from nd_region_acquire_lane(),\nwhich is bounded by nd_region-\u003enum_lanes (ND_MAX_LANES), not by nfree.\nA crafted or foreign arena whose nfree is below the lane count makes\nfreelist[lane]/rtt[lane] run past the allocation: an out-of-bounds write.\n\nbtt.rst documents the nlanes = min(nfree, num_cpus) invariant, which the\ncode does not currently honor: num_lanes is ND_MAX_LANES regardless of\nnfree.  Reject an arena whose nfree is below num_lanes at discovery,\nbefore the per-lane arrays are allocated, enforcing that invariant."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The OOB write is reached via local BTT block I/O after discover_arenas() accepts a crafted on-media info block (nd_pmem_probe \u2192 nd_btt_probe/nvdimm_namespace_attach_btt \u2192 btt_init, then btt_submit_bio \u2192 btt_read_pg/btt_write_pg). virtio-pmem, QEMU nvdimm, CXL/ACPI pmem, and ndctl namespaces are local device paths, not a network protocol parser.\nAC:L - nfree is taken from the attacker-controlled BTT info block after only signature, checksum, and optional parent-UUID checks (a null UUID skips the UUID match). Setting nfree=1 below ND_MAX_LANES (256) and pinning I/O to CPU 1+ with sched_setaffinity makes rtt[lane]/freelist[lane] deterministically overrun the nfree-sized kmalloc buffers; no race is required.\nPR:L - Neither nd_open() nor btt_submit_bio() has a capable() check. Disk-group or PMEM-service accounts can write a valid-checksum info block to /dev/pmem* (typically 0660). nd_btt_probe() auto-detects BTT even on claim_class NONE, so boot or ordinary namespace probe attaches the arena; subsequent I/O from that unprivileged principal hits the OOB without init-namespace root.\nUI:N - Once a crafted arena is discovered, device_add_disk() partition scanning issues bios into btt_read_pg() and writes rtt[lane] with no victim mount or file open. Further exploitation is attacker-driven I/O on the BTT gendisk they already can access.\nS:U - The heap out-of-bounds access corrupts kmalloc objects in the same kernel that parsed the BTT arena. This is standard kernel memory corruption, not a KVM/Xen guest-to-host escape or IOMMU/DMA boundary bypass.\nC:H - btt_read_pg() stores RTT_VALID|postmap into arena-\u003ertt[lane] and btt_write_pg() reads/writes arena-\u003efreelist[lane] past the nfree-sized allocations. postmap comes from the attacker-crafted map, so adjacent slab objects are overwritten with attacker-influenced values that can be turned into an arbitrary-read primitive.\nI:H - The same lane-indexed stores are kernel heap out-of-bounds writes: rtt[] (u32 with attacker-controlled postmap) and freelist[] (block/sub/seq/has_err). Combined with CPU-affinity control of the lane index (0..255), this is an OOB write exploitable for control-flow hijacking. btt_flog_write() also writes logoff+lane*LOG_GRP_SIZE on media.\nA:H - Indexing past the nfree-sized rtt and freelist kmalloc buffers oopses or panics on poisoned slab metadata or unmapped pages. Any kernel crash from this OOB write is High availability impact and is repeatable on every I/O using a lane \u003e= nfree."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:40:43.493Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eb491343d2d1784121ad9af91c25b338c28913c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/59d5cd1f42b4bab3609512c3cb3d3540d3d21da7"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6c5313aae794ecca8f762c1a3493de5c266f120"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9bf05c63b77d000e9c01f3e47af36973887d350"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f79d1a5f2611a3d36e9312be5425cd9cb397c51"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b1faf1f099f7060b5f1f2f0d024132581f1726e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9dfa11cef4750b67591307f2c62e47a23d60e4b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a1f2e5ed9267ca19187038ac635393c165213ac"
        }
      ],
      "title": "nvdimm/btt: reject an arena whose nfree is below the lane count",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89965",
    "datePublished": "2026-09-16T10:32:46.769Z",
    "dateReserved": "2026-09-11T19:38:34.778Z",
    "dateUpdated": "2026-09-16T14:40:43.493Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89965",
      "date": "2026-09-25",
      "epss": "0.00176",
      "percentile": "0.06351"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T01:16:28.000Z",
      "cve": "CVE-2026-89965",
      "id": "msrc_CVE-2026-89965",
      "initial_release_date": "2026-09-17T01:01:45.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "nvdimm/btt: reject an arena whose nfree is below the lane count",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89965.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvdimm/btt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "eb491343d2d1784121ad9af91c25b338c28913c3",
                    "status": "affected",
                    "version": "5212e11fde4d40fa627668b4f2222d20db488f71",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "59d5cd1f42b4bab3609512c3cb3d3540d3d21da7",
                    "status": "affected",
                    "version": "5212e11fde4d40fa627668b4f2222d20db488f71",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f6c5313aae794ecca8f762c1a3493de5c266f120",
                    "status": "affected",
                    "version": "5212e11fde4d40fa627668b4f2222d20db488f71",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f9bf05c63b77d000e9c01f3e47af36973887d350",
                    "status": "affected",
                    "version": "5212e11fde4d40fa627668b4f2222d20db488f71",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6f79d1a5f2611a3d36e9312be5425cd9cb397c51",
                    "status": "affected",
                    "version": "5212e11fde4d40fa627668b4f2222d20db488f71",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6b1faf1f099f7060b5f1f2f0d024132581f1726e",
                    "status": "affected",
                    "version": "5212e11fde4d40fa627668b4f2222d20db488f71",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9dfa11cef4750b67591307f2c62e47a23d60e4b7",
                    "status": "affected",
                    "version": "5212e11fde4d40fa627668b4f2222d20db488f71",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6a1f2e5ed9267ca19187038ac635393c165213ac",
                    "status": "affected",
                    "version": "5212e11fde4d40fa627668b4f2222d20db488f71",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvdimm/btt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.2"
                  },
                  {
                    "lessThan": "4.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/btt: reject an arena whose nfree is below the lane count\n\nThe BTT info block\u0027s nfree field, the number of reserve free blocks, is\nread from the medium without validation.  btt_freelist_init() and\nbtt_rtt_init() size the per-lane freelist[] and rtt[] arrays by nfree,\nbut the I/O path indexes them by the lane from nd_region_acquire_lane(),\nwhich is bounded by nd_region-\u003enum_lanes (ND_MAX_LANES), not by nfree.\nA crafted or foreign arena whose nfree is below the lane count makes\nfreelist[lane]/rtt[lane] run past the allocation: an out-of-bounds write.\n\nbtt.rst documents the nlanes = min(nfree, num_cpus) invariant, which the\ncode does not currently honor: num_lanes is ND_MAX_LANES regardless of\nnfree.  Reject an arena whose nfree is below num_lanes at discovery,\nbefore the per-lane arrays are allocated, enforcing that invariant."
          }
        ],
        "id": "CVE-2026-89965",
        "lastModified": "2026-09-16T15:18:20.830",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:17:07.033",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/59d5cd1f42b4bab3609512c3cb3d3540d3d21da7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6a1f2e5ed9267ca19187038ac635393c165213ac"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6b1faf1f099f7060b5f1f2f0d024132581f1726e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6f79d1a5f2611a3d36e9312be5425cd9cb397c51"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9dfa11cef4750b67591307f2c62e47a23d60e4b7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eb491343d2d1784121ad9af91c25b338c28913c3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f6c5313aae794ecca8f762c1a3493de5c266f120"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f9bf05c63b77d000e9c01f3e47af36973887d350"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.