CVE-2026-90091 (GCVE-0-2026-90091)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:06 – Updated: 2026-09-18 17:52
VLAI
Title
Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan For L2CAP sockets without owning sk->sk_socket, reading l2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() -> l2cap_sock_put_chan(). This excludes simultaneous proto_ops callbacks, but access in l2cap_sock_cleanup_listen() has unsafe lockless read. [Task 1] [Task 2 (hdev->workqueue)] l2cap_sock_release(parent) l2cap_disconn_cfm l2cap_sock_cleanup_listen l2cap_conn_del bt_accept_dequeue l2cap_chan_del lock_sock(sk) l2cap_sock_teardown_cb bt_accept_unlink bt_sk(sk)->parent = NULL release_sock(sk) ----------------> lock_sock(sk) parent = /* NULL */ lock_sock(sk) <--------------------- release_sock(sk) sock_set_flag(sk, SOCK_ZAPPED) l2cap_sock_close_cb l2cap_sock_kill(sk) l2cap_sock_put_chan chan = READ l2cap_pi(sk)->chan l2cap_pi(sk)->chan = NULL l2cap_chan_hold_unless_zero l2cap_put_chan(chan) kref_get_unless_zero(&chan->ref) Task 1 may observe NULL which causes null-ptr-deref. Fix the race by taking lock_sock() in l2cap_sock_kill() to synchronize with l2cap_sock_cleanup_listen(). hold_unless_zero() is not needed here, l2cap_pi(sk)->chan owns reference if it is non-NULL. Clarify code comments vs. locking.
Severity
8 (High)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b39298044e5534612511a2ff5de03ba5f6e7a820 , < 827de6bd2865b22aaabd554540def3b8a33018ab (git)
Affected: 8c37e4338c801ebb8cee52436c01c41e009f6e87 , < 7c7ac736b50fa259ed1bdddc18d79523f07c0442 (git)
Affected: 84e718b6a814edc84159361f9f454a4e92ae91ae , < 4f8c63fe0097c9f6ea34409f82f79b3894903d91 (git)
Affected: 36da806f7fbaee56ad9e81859deec203f9728700 , < 61d5ddbd524c715b224cbe7e9f01da4e05098b19 (git)
Affected: 6fef032af0092ed5ccb767239a9ac1bc38c08a40 , < 32a7bc6e93be36b37fe61f351d312d358195bd61 (git)
Affected: 6fef032af0092ed5ccb767239a9ac1bc38c08a40 , < 66d6ef18548ae6d7dd452b84115fc82c0a73a4ea (git)
Affected: 733e76e74e406c1d1ddc7369420dd8a47f48bb8a (git)
Affected: 6.1.178 , < 6.1.188 (semver)
Affected: 6.6.145 , < 6.6.157 (semver)
Affected: 6.12.97 , < 6.12.110 (semver)
Affected: 6.18.40 , < 6.18.52 (semver)
Affected: 7.1.5 , < 7.2 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 7.2
Unaffected: 0 , < 7.2 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/bluetooth/l2cap.h",
            "net/bluetooth/l2cap_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "827de6bd2865b22aaabd554540def3b8a33018ab",
              "status": "affected",
              "version": "b39298044e5534612511a2ff5de03ba5f6e7a820",
              "versionType": "git"
            },
            {
              "lessThan": "7c7ac736b50fa259ed1bdddc18d79523f07c0442",
              "status": "affected",
              "version": "8c37e4338c801ebb8cee52436c01c41e009f6e87",
              "versionType": "git"
            },
            {
              "lessThan": "4f8c63fe0097c9f6ea34409f82f79b3894903d91",
              "status": "affected",
              "version": "84e718b6a814edc84159361f9f454a4e92ae91ae",
              "versionType": "git"
            },
            {
              "lessThan": "61d5ddbd524c715b224cbe7e9f01da4e05098b19",
              "status": "affected",
              "version": "36da806f7fbaee56ad9e81859deec203f9728700",
              "versionType": "git"
            },
            {
              "lessThan": "32a7bc6e93be36b37fe61f351d312d358195bd61",
              "status": "affected",
              "version": "6fef032af0092ed5ccb767239a9ac1bc38c08a40",
              "versionType": "git"
            },
            {
              "lessThan": "66d6ef18548ae6d7dd452b84115fc82c0a73a4ea",
              "status": "affected",
              "version": "6fef032af0092ed5ccb767239a9ac1bc38c08a40",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "733e76e74e406c1d1ddc7369420dd8a47f48bb8a",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.157",
              "status": "affected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.110",
              "status": "affected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.52",
              "status": "affected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThan": "7.2",
              "status": "affected",
              "version": "7.1.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/bluetooth/l2cap.h",
            "net/bluetooth/l2cap_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.2"
            },
            {
              "lessThan": "7.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "6.1.178",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6.145",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.12.97",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.18.40",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "7.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "7.1.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan\n\nFor L2CAP sockets without owning sk-\u003esk_socket, reading\nl2cap_pi(sk)-\u003echan may race against concurrent l2cap_sock_kill() -\u003e\nl2cap_sock_put_chan().  This excludes simultaneous proto_ops callbacks,\nbut access in l2cap_sock_cleanup_listen() has unsafe lockless read.\n\n [Task 1]                         [Task 2 (hdev-\u003eworkqueue)]\n l2cap_sock_release(parent)       l2cap_disconn_cfm\n   l2cap_sock_cleanup_listen        l2cap_conn_del\n     bt_accept_dequeue                l2cap_chan_del\n       lock_sock(sk)                    l2cap_sock_teardown_cb\n       bt_accept_unlink\n         bt_sk(sk)-\u003eparent = NULL\n       release_sock(sk) ----------------\u003e lock_sock(sk)\n                                          parent = /* NULL */\n     lock_sock(sk) \u003c--------------------- release_sock(sk)\n                                          sock_set_flag(sk, SOCK_ZAPPED)\n                                      l2cap_sock_close_cb\n                                        l2cap_sock_kill(sk)\n                                          l2cap_sock_put_chan\n     chan = READ l2cap_pi(sk)-\u003echan         l2cap_pi(sk)-\u003echan = NULL\n     l2cap_chan_hold_unless_zero            l2cap_put_chan(chan)\n       kref_get_unless_zero(\u0026chan-\u003eref)\n\nTask 1 may observe NULL which causes null-ptr-deref.\n\nFix the race by taking lock_sock() in l2cap_sock_kill() to\nsynchronize with l2cap_sock_cleanup_listen().  hold_unless_zero() is not\nneeded here, l2cap_pi(sk)-\u003echan owns reference if it is non-NULL.\n\nClarify code comments vs. locking."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - A nearby peer\u0027s HCI Disconnection Complete (hci_disconn_complete_evt \u2192 hci_disconn_cfm \u2192 l2cap_disconn_cfm on hdev-\u003erx_work) or L2CAP_DISCONN_REQ (l2cap_disconnect_req) runs l2cap_sock_put_chan on an unaccepted child created by L2CAP_CONN_REQ; the transport is Bluetooth radio range, so Adjacent not Network.\nAC:L - The attacker drives both sides: close() of their listening socket runs l2cap_sock_release \u2192 l2cap_sock_cleanup_listen \u2192 bt_accept_dequeue, while the peer\u0027s disconnect concurrently runs l2cap_sock_kill \u2192 l2cap_sock_put_chan on that child without lock_sock; repeating connect/disconnect/close hits the window.\nPR:L - l2cap_sock_create() allows unprivileged SOCK_SEQPACKET/SOCK_STREAM (only SOCK_RAW needs CAP_NET_RAW), and l2cap_validate_bredr_psm() permits dynamic PSM \u003e= 0x1001 without CAP_NET_BIND_SERVICE, so listen()+close() needs only a normal local account; AF_BLUETOOTH is init_net-only (bt_sock_create), not a userns CAP_NET_ADMIN path.\nUI:N - The attacker closes their own listening L2CAP socket and, from a radio they control, sends L2CAP_CONN_REQ then disconnect; no other user must pair, accept, or confirm during the race.\nS:U - The race corrupts the host kernel l2cap_chan stored in l2cap_pi(sk)-\u003echan of the unaccepted child; it does not escape a VM, bypass an IOMMU, or leave the kernel\u0027s own authority.\nC:H - cleanup_listen loads l2cap_pi(sk)-\u003echan then calls l2cap_chan_hold_unless_zero(); concurrent l2cap_sock_put_chan plus l2cap_conn_del\u0027s final l2cap_chan_put can kfree that object first, so kref_get_unless_zero and later l2cap_chan_lock/__set_chan_timer run on a freed kmalloc l2cap_chan that can be sprayed for disclosure.\nI:H - Winning that UAF lets cleanup_listen take l2cap_chan_lock, arm __set_chan_timer, and l2cap_chan_put on a reclaimed fake chan, corrupting mutex/timer/kref state and invoking chan-\u003eops from sprayed memory for hijack.\nA:H - If cleanup_listen observes the NULL stored by l2cap_sock_put_chan, l2cap_chan_hold_unless_zero() calls kref_get_unless_zero(\u0026c-\u003ekref) with c==NULL and oopses; the UAF interleaving likewise panics on poisoned slab or a corrupted chan mutex."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:52:56.765Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/827de6bd2865b22aaabd554540def3b8a33018ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c7ac736b50fa259ed1bdddc18d79523f07c0442"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f8c63fe0097c9f6ea34409f82f79b3894903d91"
        },
        {
          "url": "https://git.kernel.org/stable/c/61d5ddbd524c715b224cbe7e9f01da4e05098b19"
        },
        {
          "url": "https://git.kernel.org/stable/c/32a7bc6e93be36b37fe61f351d312d358195bd61"
        },
        {
          "url": "https://git.kernel.org/stable/c/66d6ef18548ae6d7dd452b84115fc82c0a73a4ea"
        }
      ],
      "title": "Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90091",
    "datePublished": "2026-09-17T16:06:05.478Z",
    "dateReserved": "2026-09-11T19:38:34.786Z",
    "dateUpdated": "2026-09-18T17:52:56.765Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90091",
      "date": "2026-09-25",
      "epss": "0.00415",
      "percentile": "0.33147"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T01:12:51.000Z",
      "cve": "CVE-2026-90091",
      "id": "msrc_CVE-2026-90091",
      "initial_release_date": "2026-09-19T01:04:37.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90091.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/bluetooth/l2cap.h",
                  "net/bluetooth/l2cap_sock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "827de6bd2865b22aaabd554540def3b8a33018ab",
                    "status": "affected",
                    "version": "b39298044e5534612511a2ff5de03ba5f6e7a820",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7c7ac736b50fa259ed1bdddc18d79523f07c0442",
                    "status": "affected",
                    "version": "8c37e4338c801ebb8cee52436c01c41e009f6e87",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4f8c63fe0097c9f6ea34409f82f79b3894903d91",
                    "status": "affected",
                    "version": "84e718b6a814edc84159361f9f454a4e92ae91ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "61d5ddbd524c715b224cbe7e9f01da4e05098b19",
                    "status": "affected",
                    "version": "36da806f7fbaee56ad9e81859deec203f9728700",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "32a7bc6e93be36b37fe61f351d312d358195bd61",
                    "status": "affected",
                    "version": "6fef032af0092ed5ccb767239a9ac1bc38c08a40",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "66d6ef18548ae6d7dd452b84115fc82c0a73a4ea",
                    "status": "affected",
                    "version": "6fef032af0092ed5ccb767239a9ac1bc38c08a40",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "733e76e74e406c1d1ddc7369420dd8a47f48bb8a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1.188",
                    "status": "affected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.157",
                    "status": "affected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.110",
                    "status": "affected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18.52",
                    "status": "affected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "7.2",
                    "status": "affected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/bluetooth/l2cap.h",
                  "net/bluetooth/l2cap_sock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.2"
                  },
                  {
                    "lessThan": "7.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan\n\nFor L2CAP sockets without owning sk-\u003esk_socket, reading\nl2cap_pi(sk)-\u003echan may race against concurrent l2cap_sock_kill() -\u003e\nl2cap_sock_put_chan().  This excludes simultaneous proto_ops callbacks,\nbut access in l2cap_sock_cleanup_listen() has unsafe lockless read.\n\n [Task 1]                         [Task 2 (hdev-\u003eworkqueue)]\n l2cap_sock_release(parent)       l2cap_disconn_cfm\n   l2cap_sock_cleanup_listen        l2cap_conn_del\n     bt_accept_dequeue                l2cap_chan_del\n       lock_sock(sk)                    l2cap_sock_teardown_cb\n       bt_accept_unlink\n         bt_sk(sk)-\u003eparent = NULL\n       release_sock(sk) ----------------\u003e lock_sock(sk)\n                                          parent = /* NULL */\n     lock_sock(sk) \u003c--------------------- release_sock(sk)\n                                          sock_set_flag(sk, SOCK_ZAPPED)\n                                      l2cap_sock_close_cb\n                                        l2cap_sock_kill(sk)\n                                          l2cap_sock_put_chan\n     chan = READ l2cap_pi(sk)-\u003echan         l2cap_pi(sk)-\u003echan = NULL\n     l2cap_chan_hold_unless_zero            l2cap_put_chan(chan)\n       kref_get_unless_zero(\u0026chan-\u003eref)\n\nTask 1 may observe NULL which causes null-ptr-deref.\n\nFix the race by taking lock_sock() in l2cap_sock_kill() to\nsynchronize with l2cap_sock_cleanup_listen().  hold_unless_zero() is not\nneeded here, l2cap_pi(sk)-\u003echan owns reference if it is non-NULL.\n\nClarify code comments vs. locking."
          }
        ],
        "id": "CVE-2026-90091",
        "lastModified": "2026-09-18T18:17:41.277",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.1,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:00.563",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/32a7bc6e93be36b37fe61f351d312d358195bd61"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4f8c63fe0097c9f6ea34409f82f79b3894903d91"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/61d5ddbd524c715b224cbe7e9f01da4e05098b19"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/66d6ef18548ae6d7dd452b84115fc82c0a73a4ea"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7c7ac736b50fa259ed1bdddc18d79523f07c0442"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/827de6bd2865b22aaabd554540def3b8a33018ab"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.