CVE-2026-90224 (GCVE-0-2026-90224)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:07 – Updated: 2026-09-18 17:53
VLAI
Title
nfc: nci: fix double completion race in nci_data_exchange_complete
Summary
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in nci_data_exchange_complete nci_close_device() and nci_rx_work can both call nci_data_exchange_complete() concurrently. After commit 4527025d440ce8 ("nfc: nci: fix circular locking dependency in nci_close_device") moved flush_workqueue(ndev->rx_wq) after mutex_unlock(&ndev->req_lock), rx_work is no longer serialized with the explicit completion call in the close path. Both callers read the non-NULL callback pointer and invoke rawsock_data_exchange_complete(), which calls sock_put() -- but only one sock_hold() was taken, so the second sock_put() underflows the refcount and frees the socket while it is still in use. Replace the bare clear_bit(NCI_DATA_EXCHANGE) with test_and_clear_bit() so that only the first caller proceeds to invoke the callback.
Severity
7.5 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7ed00a3edc8597fe2333f524401e2889aa1b5edf , < 3f075832734005310740d148d1cf1c1e792ebdca (git)
Affected: 5eef9ebec7f5738f12cadede3545c05b34bf5ac3 , < 588ccd19a6e69eca72d54608c3ab3b45709b2305 (git)
Affected: ca54e904a071aa65ef3ad46ba42d51aaac6b73b4 , < cf646a9f5554bc07d6ccb59c327812b3a0c6a368 (git)
Affected: eb435d150ca74b4d40f77f1a2266f3636ed64a79 , < 9030a1bbe2c6b1e3e54cef462d159b5248f09fd2 (git)
Affected: 1edc12d2bbcb7a8d0f1088e6fccb9d8c01bb1289 , < bfdf412208fea7fc0d5b32d68a35b25261917393 (git)
Affected: d89b74bf08f067b55c03d7f999ba0a0e73177eb3 , < ba4c776af3dc21ed04e315e6545e99703bb1b53a (git)
Affected: 4527025d440ce84bf56e75ce1df2e84cb8178616 , < ee08414d78b851e3d1856d6e4d631939b01a1bbe (git)
Affected: 4527025d440ce84bf56e75ce1df2e84cb8178616 , < 8265a626cc14a48e46e6dc8c47667e72b4232ac2 (git)
Affected: 09143c0e8f3b03517e6233aad42f45c794d8df8e (git)
Affected: 5.10.253 , < 5.10.270 (semver)
Affected: 5.15.203 , < 5.15.221 (semver)
Affected: 6.1.168 , < 6.1.188 (semver)
Affected: 6.6.131 , < 6.6.157 (semver)
Affected: 6.12.80 , < 6.12.110 (semver)
Affected: 6.18.21 , < 6.18.52 (semver)
Affected: 6.19.11 , < 6.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/nci/data.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3f075832734005310740d148d1cf1c1e792ebdca",
              "status": "affected",
              "version": "7ed00a3edc8597fe2333f524401e2889aa1b5edf",
              "versionType": "git"
            },
            {
              "lessThan": "588ccd19a6e69eca72d54608c3ab3b45709b2305",
              "status": "affected",
              "version": "5eef9ebec7f5738f12cadede3545c05b34bf5ac3",
              "versionType": "git"
            },
            {
              "lessThan": "cf646a9f5554bc07d6ccb59c327812b3a0c6a368",
              "status": "affected",
              "version": "ca54e904a071aa65ef3ad46ba42d51aaac6b73b4",
              "versionType": "git"
            },
            {
              "lessThan": "9030a1bbe2c6b1e3e54cef462d159b5248f09fd2",
              "status": "affected",
              "version": "eb435d150ca74b4d40f77f1a2266f3636ed64a79",
              "versionType": "git"
            },
            {
              "lessThan": "bfdf412208fea7fc0d5b32d68a35b25261917393",
              "status": "affected",
              "version": "1edc12d2bbcb7a8d0f1088e6fccb9d8c01bb1289",
              "versionType": "git"
            },
            {
              "lessThan": "ba4c776af3dc21ed04e315e6545e99703bb1b53a",
              "status": "affected",
              "version": "d89b74bf08f067b55c03d7f999ba0a0e73177eb3",
              "versionType": "git"
            },
            {
              "lessThan": "ee08414d78b851e3d1856d6e4d631939b01a1bbe",
              "status": "affected",
              "version": "4527025d440ce84bf56e75ce1df2e84cb8178616",
              "versionType": "git"
            },
            {
              "lessThan": "8265a626cc14a48e46e6dc8c47667e72b4232ac2",
              "status": "affected",
              "version": "4527025d440ce84bf56e75ce1df2e84cb8178616",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "09143c0e8f3b03517e6233aad42f45c794d8df8e",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.270",
              "status": "affected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.221",
              "status": "affected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.157",
              "status": "affected",
              "version": "6.6.131",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.110",
              "status": "affected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.52",
              "status": "affected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/nci/data.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.10.253",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.15.203",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "6.1.168",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6.131",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.12.80",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.18.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: fix double completion race in nci_data_exchange_complete\n\nnci_close_device() and nci_rx_work can both call\nnci_data_exchange_complete() concurrently.  After commit 4527025d440ce8\n(\"nfc: nci: fix circular locking dependency in nci_close_device\") moved\nflush_workqueue(ndev-\u003erx_wq) after mutex_unlock(\u0026ndev-\u003ereq_lock),\nrx_work is no longer serialized with the explicit completion call in the\nclose path.  Both callers read the non-NULL callback pointer and invoke\nrawsock_data_exchange_complete(), which calls sock_put() -- but only one\nsock_hold() was taken, so the second sock_put() underflows the refcount\nand frees the socket while it is still in use.\n\nReplace the bare clear_bit(NCI_DATA_EXCHANGE) with\ntest_and_clear_bit() so that only the first caller proceeds to invoke\nthe callback."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - One completion is nci_rx_work() handling an NCI_MT_DATA_PKT (nci_rx_data_packet()\u2192nci_add_rx_data_frag()\u2192nci_data_exchange_complete()), with that skb queued by nci_recv_frame() from the NFC controller as NFC RF traffic; NFC radio range is Adjacent, not a routable IP transport.\nAC:H - The bug is nci_close_device() and nci_rx_work() both invoking nci_data_exchange_complete() after flush_workqueue(ndev-\u003erx_wq) moved past mutex_unlock(\u0026ndev-\u003ereq_lock). An NFC peer can drive rx_work but cannot start that close: nfc_dev_down() returns -EBUSY while active_target is set, and nci_unregister_device() is driver teardown the peer cannot initiate.\nPR:N - nci_recv_frame()\u2192nci_rx_work() processes NCI frames with no capability or authentication check, so an in-range NFC peer needs no host account. GENL_ADMIN_PERM on nfc_genl_dev_down()/NFC_CMD_DEV_DOWN is only the victim-side close gate, not a privilege the adjacent attacker must hold.\nUI:N - With NFC already up and nci_transceive() having set NCI_DATA_EXCHANGE (normal for a polling reader or in-progress tag session), the peer\u0027s DATA packet completes via nci_rx_work with no further click, mount, or prompt; concurrent nci_close_device() is an AC condition, not a required victim action.\nS:U - The extra sock_put() in rawsock_data_exchange_complete() frees a host kernel struct sock; impact stays in the same kernel authority with no VM escape, IOMMU bypass, or sandbox crossing.\nC:H - nci_close_device() and nci_rx_work() both read conn_info-\u003edata_exchange_cb and call rawsock_data_exchange_complete(), which sock_put()s the sk held once by sock_hold() in rawsock_tx_work(); the second put underflows that refcount and frees the socket while still referenced, a UAF read primitive.\nI:H - The same double sock_put() of the PF_NFC SOCK_SEQPACKET socket is a kernel UAF on struct sock, and the second callback runs against that freed object, giving a heap write/control-flow hijack primitive.\nA:H - Refcount underflow and the second rawsock_data_exchange_complete() on the already-freed sk (or __sk_destruct racing the second put, the path that also hit nci_close_device lockdep) cause a kernel oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:51.131Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3f075832734005310740d148d1cf1c1e792ebdca"
        },
        {
          "url": "https://git.kernel.org/stable/c/588ccd19a6e69eca72d54608c3ab3b45709b2305"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf646a9f5554bc07d6ccb59c327812b3a0c6a368"
        },
        {
          "url": "https://git.kernel.org/stable/c/9030a1bbe2c6b1e3e54cef462d159b5248f09fd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfdf412208fea7fc0d5b32d68a35b25261917393"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba4c776af3dc21ed04e315e6545e99703bb1b53a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee08414d78b851e3d1856d6e4d631939b01a1bbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/8265a626cc14a48e46e6dc8c47667e72b4232ac2"
        }
      ],
      "title": "nfc: nci: fix double completion race in nci_data_exchange_complete",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90224",
    "datePublished": "2026-09-17T16:07:34.009Z",
    "dateReserved": "2026-09-11T19:38:34.794Z",
    "dateUpdated": "2026-09-18T17:53:51.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90224",
      "date": "2026-09-25",
      "epss": "0.00357",
      "percentile": "0.26728"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/nfc/nci/data.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3f075832734005310740d148d1cf1c1e792ebdca",
                    "status": "affected",
                    "version": "7ed00a3edc8597fe2333f524401e2889aa1b5edf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "588ccd19a6e69eca72d54608c3ab3b45709b2305",
                    "status": "affected",
                    "version": "5eef9ebec7f5738f12cadede3545c05b34bf5ac3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cf646a9f5554bc07d6ccb59c327812b3a0c6a368",
                    "status": "affected",
                    "version": "ca54e904a071aa65ef3ad46ba42d51aaac6b73b4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9030a1bbe2c6b1e3e54cef462d159b5248f09fd2",
                    "status": "affected",
                    "version": "eb435d150ca74b4d40f77f1a2266f3636ed64a79",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bfdf412208fea7fc0d5b32d68a35b25261917393",
                    "status": "affected",
                    "version": "1edc12d2bbcb7a8d0f1088e6fccb9d8c01bb1289",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ba4c776af3dc21ed04e315e6545e99703bb1b53a",
                    "status": "affected",
                    "version": "d89b74bf08f067b55c03d7f999ba0a0e73177eb3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ee08414d78b851e3d1856d6e4d631939b01a1bbe",
                    "status": "affected",
                    "version": "4527025d440ce84bf56e75ce1df2e84cb8178616",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8265a626cc14a48e46e6dc8c47667e72b4232ac2",
                    "status": "affected",
                    "version": "4527025d440ce84bf56e75ce1df2e84cb8178616",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "09143c0e8f3b03517e6233aad42f45c794d8df8e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.10.270",
                    "status": "affected",
                    "version": "5.10.253",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.15.221",
                    "status": "affected",
                    "version": "5.15.203",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.188",
                    "status": "affected",
                    "version": "6.1.168",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.157",
                    "status": "affected",
                    "version": "6.6.131",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.110",
                    "status": "affected",
                    "version": "6.12.80",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18.52",
                    "status": "affected",
                    "version": "6.18.21",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.20",
                    "status": "affected",
                    "version": "6.19.11",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/nfc/nci/data.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.0"
                  },
                  {
                    "lessThan": "7.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: fix double completion race in nci_data_exchange_complete\n\nnci_close_device() and nci_rx_work can both call\nnci_data_exchange_complete() concurrently.  After commit 4527025d440ce8\n(\"nfc: nci: fix circular locking dependency in nci_close_device\") moved\nflush_workqueue(ndev-\u003erx_wq) after mutex_unlock(\u0026ndev-\u003ereq_lock),\nrx_work is no longer serialized with the explicit completion call in the\nclose path.  Both callers read the non-NULL callback pointer and invoke\nrawsock_data_exchange_complete(), which calls sock_put() -- but only one\nsock_hold() was taken, so the second sock_put() underflows the refcount\nand frees the socket while it is still in use.\n\nReplace the bare clear_bit(NCI_DATA_EXCHANGE) with\ntest_and_clear_bit() so that only the first caller proceeds to invoke\nthe callback."
          }
        ],
        "id": "CVE-2026-90224",
        "lastModified": "2026-09-18T18:17:47.140",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:17.997",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3f075832734005310740d148d1cf1c1e792ebdca"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/588ccd19a6e69eca72d54608c3ab3b45709b2305"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8265a626cc14a48e46e6dc8c47667e72b4232ac2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9030a1bbe2c6b1e3e54cef462d159b5248f09fd2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ba4c776af3dc21ed04e315e6545e99703bb1b53a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bfdf412208fea7fc0d5b32d68a35b25261917393"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cf646a9f5554bc07d6ccb59c327812b3a0c6a368"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ee08414d78b851e3d1856d6e4d631939b01a1bbe"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.