CVE-2026-90325 (GCVE-0-2026-90325)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:08 – Updated: 2026-09-18 17:54
VLAI
Title
blk-cgroup: skip dying blkg in blkcg_activate_policy()
Summary
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: skip dying blkg in blkcg_activate_policy() When switching IO schedulers on a block device, blkcg_activate_policy() can race with concurrent blkcg deletion, leading to a use-after-free in rcu_accelerate_cbs. T1: T2: blkg_destroy kill(&blkg->refcnt) // blkg->refcnt=1->0 blkg_release // call_rcu(__blkg_release) ... blkg_free_workfn ->pd_free_fn(pd) elv_iosched_store elevator_switch ... iterate blkg list blkg_get(blkg) // blkg->refcnt=0->1 list_del_init(&blkg->q_node) blkg_put(pinned_blkg) // blkg->refcnt=1->0 blkg_release // call_rcu again rcu_accelerate_cbs // uaf Fix this by checking hlist_unhashed(&blkg->blkcg_node) before getting a reference to the blkg. This is the same check used in blkg_destroy() to detect if a blkg has already been destroyed. If the blkg is already unhashed, skip processing it since it's being destroyed.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 81c1188905f88b77743d1fdeeedfc8cb7b67787d , < b5dae1cd0d8368b4338430ff93403df67f0b8bcc (git)
Affected: bfe46d2efe46c5c952f982e2ca94fe2ec5e58e2a , < 083b58373463a6e5ee60ecb135269348f68ad7df (git)
Affected: f1c006f1c6850c14040f8337753a63119bba39b9 , < 1a267295b1ea6a6477963f3fda84adfecd48fcad (git)
Affected: f1c006f1c6850c14040f8337753a63119bba39b9 , < 7337d012ca3fc3a6a2d1c8e2a19c6d97c38b410d (git)
Affected: f1c006f1c6850c14040f8337753a63119bba39b9 , < 3d8c3da95c75a4d312e272fc7b4076dd3ba9115c (git)
Affected: f1c006f1c6850c14040f8337753a63119bba39b9 , < d8c872901e6459339374e9eea80aa919176c2ccd (git)
Affected: f1c006f1c6850c14040f8337753a63119bba39b9 , < 5e9220389920f33b6a804d50c548cd0cd1b04634 (git)
Affected: 6.1.16 , < 6.1.17 (semver)
Affected: 6.2.3 , < 6.2.4 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.1.17 , ≤ 6.1.* (semver)
Unaffected: 6.2.4 , ≤ 6.2.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b5dae1cd0d8368b4338430ff93403df67f0b8bcc",
              "status": "affected",
              "version": "81c1188905f88b77743d1fdeeedfc8cb7b67787d",
              "versionType": "git"
            },
            {
              "lessThan": "083b58373463a6e5ee60ecb135269348f68ad7df",
              "status": "affected",
              "version": "bfe46d2efe46c5c952f982e2ca94fe2ec5e58e2a",
              "versionType": "git"
            },
            {
              "lessThan": "1a267295b1ea6a6477963f3fda84adfecd48fcad",
              "status": "affected",
              "version": "f1c006f1c6850c14040f8337753a63119bba39b9",
              "versionType": "git"
            },
            {
              "lessThan": "7337d012ca3fc3a6a2d1c8e2a19c6d97c38b410d",
              "status": "affected",
              "version": "f1c006f1c6850c14040f8337753a63119bba39b9",
              "versionType": "git"
            },
            {
              "lessThan": "3d8c3da95c75a4d312e272fc7b4076dd3ba9115c",
              "status": "affected",
              "version": "f1c006f1c6850c14040f8337753a63119bba39b9",
              "versionType": "git"
            },
            {
              "lessThan": "d8c872901e6459339374e9eea80aa919176c2ccd",
              "status": "affected",
              "version": "f1c006f1c6850c14040f8337753a63119bba39b9",
              "versionType": "git"
            },
            {
              "lessThan": "5e9220389920f33b6a804d50c548cd0cd1b04634",
              "status": "affected",
              "version": "f1c006f1c6850c14040f8337753a63119bba39b9",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.17",
              "status": "affected",
              "version": "6.1.16",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.4",
              "status": "affected",
              "version": "6.2.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.17",
                  "versionStartIncluding": "6.1.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.4",
                  "versionStartIncluding": "6.2.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: skip dying blkg in blkcg_activate_policy()\n\nWhen switching IO schedulers on a block device, blkcg_activate_policy()\ncan race with concurrent blkcg deletion, leading to a use-after-free in\nrcu_accelerate_cbs.\n\nT1:                               T2:\n                                  blkg_destroy\n                                  kill(\u0026blkg-\u003erefcnt) // blkg-\u003erefcnt=1-\u003e0\n                                  blkg_release // call_rcu(__blkg_release)\n                                  ...\n                                  blkg_free_workfn\n                                  -\u003epd_free_fn(pd)\nelv_iosched_store\nelevator_switch\n...\niterate blkg list\nblkg_get(blkg) // blkg-\u003erefcnt=0-\u003e1\n                                  list_del_init(\u0026blkg-\u003eq_node)\nblkg_put(pinned_blkg) // blkg-\u003erefcnt=1-\u003e0\nblkg_release // call_rcu again\nrcu_accelerate_cbs // uaf\n\nFix this by checking hlist_unhashed(\u0026blkg-\u003eblkcg_node) before getting\na reference to the blkg. This is the same check used in blkg_destroy()\nto detect if a blkg has already been destroyed. If the blkg is already\nunhashed, skip processing it since it\u0027s being destroyed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached by writing the local sysfs file /sys/block/\u003cdev\u003e/queue/scheduler (elv_iosched_store \u2192 elevator_switch \u2192 bfq_create_group_hierarchy \u2192 blkcg_activate_policy) or by writing the local cgroup files io.max (tg_set_limit \u2192 blk_throtl_init) or io.latency (iolatency_set_limit \u2192 blk_iolatency_init). No remote protocol carries the triggering state.\nAC:L - The attacker drives both sides: one thread writes io.max/io.latency or queue/scheduler so blkcg_activate_policy() takes the GFP_NOWAIT-fail retry and calls blkg_get() on a q-\u003eblkg_list entry, while another rmdirs a sibling io cgroup so blkcg_css_offline() \u2192 blkg_destroy() kills that blkg\u0027s percpu_ref. The mkdir/write/rmdir cycle can be repeated until the window hits.\nPR:L - cgroup_add_file() creates io.max and io.latency with mode 0644 and current_fsuid(), so an unprivileged user who mkdir\u0027s in a delegated cgroup v2 subtree (systemd user@.service, rootless containers) can write those files and rmdir the cgroup. tg_set_limit()/iolatency_set_limit() have no capability check, and blkg_conf_open_bdev() looks up the disk by MAJ:MIN via blkdev_get_no_open() without opening it.\nUI:N - The attacker performs the mkdir, the io.max/io.latency or scheduler write that enters blkcg_activate_policy(), and the concurrent rmdir that runs blkg_destroy(), all from its own processes; no other user must mount a device or open a file.\nS:U - Double call_rcu on blkg-\u003ercu_head corrupts host-kernel RCU callback lists and the slab-backed blkcg_gq. That stays inside the same kernel security authority and is not a VM, IOMMU, or hypervisor escape.\nC:H - blkcg_activate_policy() calls blkg_get() (percpu_ref_get, not tryget) on a blkg whose refcnt blkg_destroy() already killed, resurrecting it; the matching blkg_put() after mutex_unlock races blkg_free_workfn()\u0027s kfree(blkg) and issues a second call_rcu on the same rcu_head, which the report shows as a UAF in rcu_accelerate_cbs. A UAF on the RCU list and blkcg_gq is an arbitrary kernel-memory read.\nI:H - The second call_rcu(\u0026blkg-\u003ercu_head) from the resurrected blkg_put() corrupts the RCU callback list (rcu_accelerate_cbs) while blkg_free_workfn() still does list_del_init() and pd_free_fn() on that object. Those writes through a freed, sprayable blkcg_gq are a kernel write primitive suitable for control-flow hijack.\nA:H - The commit documents a use-after-free in rcu_accelerate_cbs from the second call_rcu on blkg-\u003ercu_head after blkg_get() resurrects a killed ref; that UAF oopses or panics the kernel even if it is not further exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:37.929Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b5dae1cd0d8368b4338430ff93403df67f0b8bcc"
        },
        {
          "url": "https://git.kernel.org/stable/c/083b58373463a6e5ee60ecb135269348f68ad7df"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a267295b1ea6a6477963f3fda84adfecd48fcad"
        },
        {
          "url": "https://git.kernel.org/stable/c/7337d012ca3fc3a6a2d1c8e2a19c6d97c38b410d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d8c3da95c75a4d312e272fc7b4076dd3ba9115c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8c872901e6459339374e9eea80aa919176c2ccd"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e9220389920f33b6a804d50c548cd0cd1b04634"
        }
      ],
      "title": "blk-cgroup: skip dying blkg in blkcg_activate_policy()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90325",
    "datePublished": "2026-09-17T16:08:40.710Z",
    "dateReserved": "2026-09-11T19:38:34.802Z",
    "dateUpdated": "2026-09-18T17:54:37.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90325",
      "date": "2026-10-02",
      "epss": "0.00171",
      "percentile": "0.05857"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "block/blk-cgroup.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b5dae1cd0d8368b4338430ff93403df67f0b8bcc",
                    "status": "affected",
                    "version": "81c1188905f88b77743d1fdeeedfc8cb7b67787d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "083b58373463a6e5ee60ecb135269348f68ad7df",
                    "status": "affected",
                    "version": "bfe46d2efe46c5c952f982e2ca94fe2ec5e58e2a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1a267295b1ea6a6477963f3fda84adfecd48fcad",
                    "status": "affected",
                    "version": "f1c006f1c6850c14040f8337753a63119bba39b9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7337d012ca3fc3a6a2d1c8e2a19c6d97c38b410d",
                    "status": "affected",
                    "version": "f1c006f1c6850c14040f8337753a63119bba39b9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3d8c3da95c75a4d312e272fc7b4076dd3ba9115c",
                    "status": "affected",
                    "version": "f1c006f1c6850c14040f8337753a63119bba39b9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d8c872901e6459339374e9eea80aa919176c2ccd",
                    "status": "affected",
                    "version": "f1c006f1c6850c14040f8337753a63119bba39b9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5e9220389920f33b6a804d50c548cd0cd1b04634",
                    "status": "affected",
                    "version": "f1c006f1c6850c14040f8337753a63119bba39b9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1.17",
                    "status": "affected",
                    "version": "6.1.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.2.4",
                    "status": "affected",
                    "version": "6.2.3",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "block/blk-cgroup.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.3"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.17",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: skip dying blkg in blkcg_activate_policy()\n\nWhen switching IO schedulers on a block device, blkcg_activate_policy()\ncan race with concurrent blkcg deletion, leading to a use-after-free in\nrcu_accelerate_cbs.\n\nT1:                               T2:\n                                  blkg_destroy\n                                  kill(\u0026blkg-\u003erefcnt) // blkg-\u003erefcnt=1-\u003e0\n                                  blkg_release // call_rcu(__blkg_release)\n                                  ...\n                                  blkg_free_workfn\n                                  -\u003epd_free_fn(pd)\nelv_iosched_store\nelevator_switch\n...\niterate blkg list\nblkg_get(blkg) // blkg-\u003erefcnt=0-\u003e1\n                                  list_del_init(\u0026blkg-\u003eq_node)\nblkg_put(pinned_blkg) // blkg-\u003erefcnt=1-\u003e0\nblkg_release // call_rcu again\nrcu_accelerate_cbs // uaf\n\nFix this by checking hlist_unhashed(\u0026blkg-\u003eblkcg_node) before getting\na reference to the blkg. This is the same check used in blkg_destroy()\nto detect if a blkg has already been destroyed. If the blkg is already\nunhashed, skip processing it since it\u0027s being destroyed."
          }
        ],
        "id": "CVE-2026-90325",
        "lastModified": "2026-09-18T18:17:53.960",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:30.540",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/083b58373463a6e5ee60ecb135269348f68ad7df"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1a267295b1ea6a6477963f3fda84adfecd48fcad"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3d8c3da95c75a4d312e272fc7b4076dd3ba9115c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5e9220389920f33b6a804d50c548cd0cd1b04634"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7337d012ca3fc3a6a2d1c8e2a19c6d97c38b410d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b5dae1cd0d8368b4338430ff93403df67f0b8bcc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d8c872901e6459339374e9eea80aa919176c2ccd"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.