GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40039 (GCVE-0-2025-40039)

Vulnerability from cvelistv5 – Published: 2025-10-28 11:48 – Updated: 2026-08-05 12:07
VLAI
Title
ksmbd: Fix race condition in RPC handle list access
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix race condition in RPC handle list access The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd session. Access to this list is intended to be protected by 'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was flawed, leading to potential race conditions. In ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock before calling xa_store() and xa_erase(). Since these operations modify the XArray structure, a write lock is required to ensure exclusive access and prevent data corruption from concurrent modifications. Furthermore, ksmbd_session_rpc_method() accessed the list using xa_load() without holding any lock at all. This could lead to reading inconsistent data or a potential use-after-free if an entry is concurrently removed and the pointer is dereferenced. Fix these issues by: 1. Using down_write() and up_write() in ksmbd_session_rpc_open() to ensure exclusive access during XArray modification, and ensuring the lock is correctly released on error paths. 2. Adding down_read() and up_read() in ksmbd_session_rpc_method() to safely protect the lookup.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a4348710a7267705b75692dc1a000920481d1d92 , < 69674b029002b1d90b655f014bdf64f404efa54d (git)
Affected: b685757c7b08d5073046fb379be965fd6c06aafc , < 6b615a8fb3af0baf8126cde3d4fee97d57222ffc (git)
Affected: b685757c7b08d5073046fb379be965fd6c06aafc , < 5cc679ba0f4505936124cd4179ba66bb0a4bd9f3 (git)
Affected: b685757c7b08d5073046fb379be965fd6c06aafc , < 6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1 (git)
Affected: b685757c7b08d5073046fb379be965fd6c06aafc , < 305853cce379407090a73b38c5de5ba748893aee (git)
Affected: 1f485b54d04a920723984062c912174330a05178 (git)
Affected: 052b41ef2abe274f068e892aee81406f11bd1f3a (git)
Affected: 5.15.145 , < 5.16 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.123 , ≤ 6.6.* (semver)
Unaffected: 6.12.53 , ≤ 6.12.* (semver)
Unaffected: 6.17.3 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/user_session.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "69674b029002b1d90b655f014bdf64f404efa54d",
              "status": "affected",
              "version": "a4348710a7267705b75692dc1a000920481d1d92",
              "versionType": "git"
            },
            {
              "lessThan": "6b615a8fb3af0baf8126cde3d4fee97d57222ffc",
              "status": "affected",
              "version": "b685757c7b08d5073046fb379be965fd6c06aafc",
              "versionType": "git"
            },
            {
              "lessThan": "5cc679ba0f4505936124cd4179ba66bb0a4bd9f3",
              "status": "affected",
              "version": "b685757c7b08d5073046fb379be965fd6c06aafc",
              "versionType": "git"
            },
            {
              "lessThan": "6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1",
              "status": "affected",
              "version": "b685757c7b08d5073046fb379be965fd6c06aafc",
              "versionType": "git"
            },
            {
              "lessThan": "305853cce379407090a73b38c5de5ba748893aee",
              "status": "affected",
              "version": "b685757c7b08d5073046fb379be965fd6c06aafc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1f485b54d04a920723984062c912174330a05178",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "052b41ef2abe274f068e892aee81406f11bd1f3a",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.145",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/user_session.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.123",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.123",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.145",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix race condition in RPC handle list access\n\nThe \u0027sess-\u003erpc_handle_list\u0027 XArray manages RPC handles within a ksmbd\nsession. Access to this list is intended to be protected by\n\u0027sess-\u003erpc_lock\u0027 (an rw_semaphore). However, the locking implementation was\nflawed, leading to potential race conditions.\n\nIn ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock\nbefore calling xa_store() and xa_erase(). Since these operations modify\nthe XArray structure, a write lock is required to ensure exclusive access\nand prevent data corruption from concurrent modifications.\n\nFurthermore, ksmbd_session_rpc_method() accessed the list using xa_load()\nwithout holding any lock at all. This could lead to reading inconsistent\ndata or a potential use-after-free if an entry is concurrently removed and\nthe pointer is dereferenced.\n\nFix these issues by:\n1. Using down_write() and up_write() in ksmbd_session_rpc_open()\n   to ensure exclusive access during XArray modification, and ensuring\n   the lock is correctly released on error paths.\n2. Adding down_read() and up_read() in ksmbd_session_rpc_method()\n   to safely protect the lookup."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is in ksmbd, the in-kernel SMB server, and is driven entirely by SMB2 requests (CREATE/CLOSE/IOCTL/READ/WRITE/QUERY_INFO) arriving over TCP port 445 from a remote peer. No local access is needed.\nAC:L - The attacker controls both sides of the race: the pipe handle is an attacker-chosen VolatileFileId, and ksmbd_queue_work() executes each SMB2 request on a separate ksmbd-io worker (plus SMB3 multichannel), so concurrent SMB2_CLOSE and SMB2_IOCTL/READ/WRITE requests run in parallel with unlimited retries.\nPR:L - Reaching create_smb2_pipe() requires a session in SMB2_SESSION_VALID state (ksmbd_session_lookup_all() rejects IN_PROGRESS) plus a tree connect to IPC$, i.e. any valid low-privileged SMB account; no administrative rights are needed, and with guest mapping enabled even credentials are unnecessary.\nUI:N - The entire sequence is performed by the attacker\u0027s own SMB client against the server; no action by any local user or administrator is required.\nS:U - The use-after-free corrupts kernel heap state within the same kernel security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The unlocked xa_load() dereferences a kfree()\u0027d struct ksmbd_session_rpc, disclosing reused kernel heap contents as the RPC method flags; a UAF of this kind gives control over freed-object contents and can be leveraged into arbitrary kernel memory disclosure, and the resulting flags can steer the root ksmbd.mountd daemon into SAMR/LSARPC handlers the client never opened.\nI:H - The stale entry-\u003emethod value read from a reused 8-byte slab object is heap-groomable by the attacker and directly selects which privileged RPC method the root-privileged userspace daemon executes with client-supplied payload; use-after-free conditions are generally leverageable into arbitrary-write and control-flow hijack primitives.\nA:H - Dereferencing the freed entry after the slab object or page has been released oopses the ksmbd worker thread, and the unsynchronized RPC handle teardown corrupts session state, yielding a repeatable remote kernel crash / denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:13.052Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/69674b029002b1d90b655f014bdf64f404efa54d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b615a8fb3af0baf8126cde3d4fee97d57222ffc"
        },
        {
          "url": "https://git.kernel.org/stable/c/5cc679ba0f4505936124cd4179ba66bb0a4bd9f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/305853cce379407090a73b38c5de5ba748893aee"
        }
      ],
      "title": "ksmbd: Fix race condition in RPC handle list access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40039",
    "datePublished": "2025-10-28T11:48:19.781Z",
    "dateReserved": "2025-04-16T07:20:57.153Z",
    "dateUpdated": "2026-08-05T12:07:13.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40039",
      "date": "2026-09-16",
      "epss": "0.00301",
      "percentile": "0.2283"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:16:27.000Z",
      "cve": "CVE-2025-40039",
      "id": "msrc_CVE-2025-40039",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:known_affected": "3",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ksmbd: Fix race condition in RPC handle list access",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40039.json",
      "version": "5"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40039\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-28T12:15:37.847\",\"lastModified\":\"2026-07-30T06:24:07.150\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: Fix race condition in RPC handle list access\\n\\nThe \u0027sess-\u003erpc_handle_list\u0027 XArray manages RPC handles within a ksmbd\\nsession. Access to this list is intended to be protected by\\n\u0027sess-\u003erpc_lock\u0027 (an rw_semaphore). However, the locking implementation was\\nflawed, leading to potential race conditions.\\n\\nIn ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock\\nbefore calling xa_store() and xa_erase(). Since these operations modify\\nthe XArray structure, a write lock is required to ensure exclusive access\\nand prevent data corruption from concurrent modifications.\\n\\nFurthermore, ksmbd_session_rpc_method() accessed the list using xa_load()\\nwithout holding any lock at all. This could lead to reading inconsistent\\ndata or a potential use-after-free if an entry is concurrently removed and\\nthe pointer is dereferenced.\\n\\nFix these issues by:\\n1. Using down_write() and up_write() in ksmbd_session_rpc_open()\\n   to ensure exclusive access during XArray modification, and ensuring\\n   the lock is correctly released on error paths.\\n2. Adding down_read() and up_read() in ksmbd_session_rpc_method()\\n   to safely protect the lookup.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/mgmt/user_session.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a4348710a7267705b75692dc1a000920481d1d92\",\"lessThan\":\"69674b029002b1d90b655f014bdf64f404efa54d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b685757c7b08d5073046fb379be965fd6c06aafc\",\"lessThan\":\"6b615a8fb3af0baf8126cde3d4fee97d57222ffc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b685757c7b08d5073046fb379be965fd6c06aafc\",\"lessThan\":\"5cc679ba0f4505936124cd4179ba66bb0a4bd9f3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b685757c7b08d5073046fb379be965fd6c06aafc\",\"lessThan\":\"6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b685757c7b08d5073046fb379be965fd6c06aafc\",\"lessThan\":\"305853cce379407090a73b38c5de5ba748893aee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1f485b54d04a920723984062c912174330a05178\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"052b41ef2abe274f068e892aee81406f11bd1f3a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.145\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/mgmt/user_session.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.123\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.53\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.3\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.145\",\"versionEndExcluding\":\"5.16\",\"matchCriteriaId\":\"B98C9201-BF17-4E2C-84FF-75EE2AA94DC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.71\",\"versionEndExcluding\":\"6.2\",\"matchCriteriaId\":\"163E72B5-0F5D-49E2-AAEA-F11E02D730AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.6.123\",\"matchCriteriaId\":\"F522E23F-2E27-4FDC-A9A5-FE6B600E1D7D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.53\",\"matchCriteriaId\":\"A9028AC3-C3E8-4D5D-9235-DE8859551F7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.17.3\",\"matchCriteriaId\":\"F55A160F-1578-4C10-ABCB-F90B7E146ED8\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/305853cce379407090a73b38c5de5ba748893aee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5cc679ba0f4505936124cd4179ba66bb0a4bd9f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/69674b029002b1d90b655f014bdf64f404efa54d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6b615a8fb3af0baf8126cde3d4fee97d57222ffc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:34:09+00:00",
      "cve": "CVE-2025-40039",
      "id": "CVE-2025-40039",
      "initial_release_date": "2025-10-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: Fix race condition in RPC handle list access",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40039.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.