CVE-2026-72069 (GCVE-0-2026-72069)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-23 12:46
VLAI
Title
locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
Summary
In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() rt_spin_unlock() releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1 T2 spin_lock(&p->lock); rcu_read_lock(); invalidate(p); p = rcu_dereference(ptr); rcu_assign_pointer(ptr, NULL); if (!p) return; spin_unlock(&p->lock); spin_lock(&p->lock) lock(&lock->lock); rcu_read_lock(); kfree_rcu(p); rcu_read_unlock(); .... spin_unlock(&p->lock) rcu_read_unlock(); // Ends grace period rcu_do_batch() kfree(p); UAF -> rt_mutex_cmpxchg_release(&lock->lock...) Regular spinlocks keep preemption disabled accross the unlock operation, which provides full RCU protection, but the RT substitution fails to resemble that. Same applies for the rwlock substitution. Move the rcu_read_unlock() invocation past the unlock operations to match the non-RT semantics. This makes it asymmetric vs. rt_xxx_lock(), but that's harmless as the caller needs to hold RCU read lock across the lock operation. The migrate_enable() call stays before the unlock operation because there is no per CPU operation in the unlock path which would require migration to be kept disabled.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0f383b6dc96e976dfbf2721b0bf10bd96103b341 , < af28d801cd2db4cc7378554499bd4a5d84a5517e (git)
Affected: 0f383b6dc96e976dfbf2721b0bf10bd96103b341 , < 9d1fcd64ab81200e02b7a6db5eb1da8e244e8289 (git)
Affected: 0f383b6dc96e976dfbf2721b0bf10bd96103b341 , < 3cfaac77b3c32ac3940df28866de263c3f45d24c (git)
Affected: 0f383b6dc96e976dfbf2721b0bf10bd96103b341 , < 1f0d56d3f1e88f20f6e46109402f8c15d59bac37 (git)
Affected: 0f383b6dc96e976dfbf2721b0bf10bd96103b341 , < 633cadbc0b8323f5cc140a285d2432089dbb534e (git)
Affected: 0f383b6dc96e976dfbf2721b0bf10bd96103b341 , < 83f9fb561c1c3917e19f95523dd933c7d30291aa (git)
Affected: 0f383b6dc96e976dfbf2721b0bf10bd96103b341 , < 89038cc87d80c77e7aa6f42a64b2573b74af339f (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/locking/spinlock_rt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "af28d801cd2db4cc7378554499bd4a5d84a5517e",
              "status": "affected",
              "version": "0f383b6dc96e976dfbf2721b0bf10bd96103b341",
              "versionType": "git"
            },
            {
              "lessThan": "9d1fcd64ab81200e02b7a6db5eb1da8e244e8289",
              "status": "affected",
              "version": "0f383b6dc96e976dfbf2721b0bf10bd96103b341",
              "versionType": "git"
            },
            {
              "lessThan": "3cfaac77b3c32ac3940df28866de263c3f45d24c",
              "status": "affected",
              "version": "0f383b6dc96e976dfbf2721b0bf10bd96103b341",
              "versionType": "git"
            },
            {
              "lessThan": "1f0d56d3f1e88f20f6e46109402f8c15d59bac37",
              "status": "affected",
              "version": "0f383b6dc96e976dfbf2721b0bf10bd96103b341",
              "versionType": "git"
            },
            {
              "lessThan": "633cadbc0b8323f5cc140a285d2432089dbb534e",
              "status": "affected",
              "version": "0f383b6dc96e976dfbf2721b0bf10bd96103b341",
              "versionType": "git"
            },
            {
              "lessThan": "83f9fb561c1c3917e19f95523dd933c7d30291aa",
              "status": "affected",
              "version": "0f383b6dc96e976dfbf2721b0bf10bd96103b341",
              "versionType": "git"
            },
            {
              "lessThan": "89038cc87d80c77e7aa6f42a64b2573b74af339f",
              "status": "affected",
              "version": "0f383b6dc96e976dfbf2721b0bf10bd96103b341",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/locking/spinlock_rt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/rt: Fix the incorrect RCU protection in rt_spin_unlock()\n\nrt_spin_unlock() releases the RCU protection before unlocking the\nlock. That opens the door for the following UAF scenario:\n\n T1\t\t\t\t\tT2\n spin_lock(\u0026p-\u003elock);\t\trcu_read_lock();\n invalidate(p);\t\t\tp = rcu_dereference(ptr);\n rcu_assign_pointer(ptr, NULL);\tif (!p) return;\n spin_unlock(\u0026p-\u003elock);\t\tspin_lock(\u0026p-\u003elock)\n \t\t\t\t   lock(\u0026lock-\u003elock);\n\t\t\t\t   rcu_read_lock();\n kfree_rcu(p);\t\t\trcu_read_unlock();\n\t\t\t\t....\n\t\t\t\tspin_unlock(\u0026p-\u003elock)\n\t\t\t\t  rcu_read_unlock(); // Ends grace period\n rcu_do_batch()\n   kfree(p);\n\t\t\t    UAF -\u003e\t  rt_mutex_cmpxchg_release(\u0026lock-\u003elock...)\n\nRegular spinlocks keep preemption disabled accross the unlock operation,\nwhich provides full RCU protection, but the RT substitution fails to\nresemble that. Same applies for the rwlock substitution.\n\nMove the rcu_read_unlock() invocation past the unlock operations to match\nthe non-RT semantics. This makes it asymmetric vs. rt_xxx_lock(), but\nthat\u0027s harmless as the caller needs to hold RCU read lock across the lock\noperation. The migrate_enable() call stays before the unlock operation\nbecause there is no per CPU operation in the unlock path which would\nrequire migration to be kept disabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On CONFIG_PREEMPT_RT, every spin_unlock() is substituted by rt_spin_unlock(); network subsystems such as netfilter xt_hashlimit process inbound packets through hashlimit_mt_common(), spin_lock/unlock on RCU-protected dsthash_ent objects concurrently freed via call_rcu by GC\u2014the exact embedded-spinlock UAF pattern from the fix.\nAC:L - The bug is a cross-CPU race where rt_spin_unlock() calls rcu_read_unlock() before releasing the rtmutex, ending the RCU grace period while still dereferencing the lock; syzbot triggered this reliably on PREEMPT_RT via concurrent unlinkat and dentry teardown, and attackers control both sides with parallel syscalls or packet/GC load.\nPR:N - Remote attackers need no account, capability, or authentication to send packets that hit deployed hashlimit rules on internet-facing PREEMPT_RT gateways; the proven syzbot unlinkat path needs only directory write permission (PR:L), but PR:N reflects the highest-severity unauthenticated network packet scenario.\nUI:N - No victim interaction is required; the attacker drives the race through their own concurrent filesystem syscalls (syzbot: unlinkat racing __fput/dentry_kill) or sustained inbound traffic overlapping netfilter GC, without needing another user to open files or mount filesystems.\nS:U - The UAF corrupts kernel slab memory containing embedded spinlock/rtmutex fields and enables privilege escalation within the same kernel security authority; it does not inherently cross VM/guest, container sandbox, or IOMMU hardware isolation boundaries.\nC:H - Syzbot reported KASAN slab-use-after-free Read in rt_mutex_slowunlock during spin_unlock on a freed dentry in shrink_dcache_tree; the systemic UAF lets attackers read freed objects (dentry, dsthash_ent, etc.) after premature RCU grace-period completion, enabling kernel pointer and memory disclosure.\nI:H - UAF on embedded rtmutex fields inside freed slab objects (dentry-\u003ed_lock per syzbot) permits heap grooming and reallocation of attacker-controlled data, providing standard kernel heap corruption primitives for arbitrary write and control-flow hijack beyond the immediate crash.\nA:H - Syzbot hit KASAN slab-use-after-free causing kernel fault in shrink_dcache_tree via rt_spin_unlock on PREEMPT_RT; the bug can oops/panic any RT kernel whenever spin_unlock races RCU-deferred free of the containing object, enabling repeatable denial of service via concurrent VFS or netfilter operations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:41.836Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/af28d801cd2db4cc7378554499bd4a5d84a5517e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d1fcd64ab81200e02b7a6db5eb1da8e244e8289"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cfaac77b3c32ac3940df28866de263c3f45d24c"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f0d56d3f1e88f20f6e46109402f8c15d59bac37"
        },
        {
          "url": "https://git.kernel.org/stable/c/633cadbc0b8323f5cc140a285d2432089dbb534e"
        },
        {
          "url": "https://git.kernel.org/stable/c/83f9fb561c1c3917e19f95523dd933c7d30291aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/89038cc87d80c77e7aa6f42a64b2573b74af339f"
        }
      ],
      "title": "locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72069",
    "datePublished": "2026-08-15T05:52:21.752Z",
    "dateReserved": "2026-08-09T03:40:39.903Z",
    "dateUpdated": "2026-08-23T12:46:41.836Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72069",
      "date": "2026-08-24",
      "epss": "0.00728",
      "percentile": "0.51419"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72069\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:21:16.607\",\"lastModified\":\"2026-08-23T13:16:39.213\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlocking/rt: Fix the incorrect RCU protection in rt_spin_unlock()\\n\\nrt_spin_unlock() releases the RCU protection before unlocking the\\nlock. That opens the door for the following UAF scenario:\\n\\n T1\\t\\t\\t\\t\\tT2\\n spin_lock(\u0026p-\u003elock);\\t\\trcu_read_lock();\\n invalidate(p);\\t\\t\\tp = rcu_dereference(ptr);\\n rcu_assign_pointer(ptr, NULL);\\tif (!p) return;\\n spin_unlock(\u0026p-\u003elock);\\t\\tspin_lock(\u0026p-\u003elock)\\n \\t\\t\\t\\t   lock(\u0026lock-\u003elock);\\n\\t\\t\\t\\t   rcu_read_lock();\\n kfree_rcu(p);\\t\\t\\trcu_read_unlock();\\n\\t\\t\\t\\t....\\n\\t\\t\\t\\tspin_unlock(\u0026p-\u003elock)\\n\\t\\t\\t\\t  rcu_read_unlock(); // Ends grace period\\n rcu_do_batch()\\n   kfree(p);\\n\\t\\t\\t    UAF -\u003e\\t  rt_mutex_cmpxchg_release(\u0026lock-\u003elock...)\\n\\nRegular spinlocks keep preemption disabled accross the unlock operation,\\nwhich provides full RCU protection, but the RT substitution fails to\\nresemble that. Same applies for the rwlock substitution.\\n\\nMove the rcu_read_unlock() invocation past the unlock operations to match\\nthe non-RT semantics. This makes it asymmetric vs. rt_xxx_lock(), but\\nthat\u0027s harmless as the caller needs to hold RCU read lock across the lock\\noperation. The migrate_enable() call stays before the unlock operation\\nbecause there is no per CPU operation in the unlock path which would\\nrequire migration to be kept disabled.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/locking/spinlock_rt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0f383b6dc96e976dfbf2721b0bf10bd96103b341\",\"lessThan\":\"af28d801cd2db4cc7378554499bd4a5d84a5517e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f383b6dc96e976dfbf2721b0bf10bd96103b341\",\"lessThan\":\"9d1fcd64ab81200e02b7a6db5eb1da8e244e8289\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f383b6dc96e976dfbf2721b0bf10bd96103b341\",\"lessThan\":\"3cfaac77b3c32ac3940df28866de263c3f45d24c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f383b6dc96e976dfbf2721b0bf10bd96103b341\",\"lessThan\":\"1f0d56d3f1e88f20f6e46109402f8c15d59bac37\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f383b6dc96e976dfbf2721b0bf10bd96103b341\",\"lessThan\":\"633cadbc0b8323f5cc140a285d2432089dbb534e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f383b6dc96e976dfbf2721b0bf10bd96103b341\",\"lessThan\":\"83f9fb561c1c3917e19f95523dd933c7d30291aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f383b6dc96e976dfbf2721b0bf10bd96103b341\",\"lessThan\":\"89038cc87d80c77e7aa6f42a64b2573b74af339f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/locking/spinlock_rt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.217\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.184\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1f0d56d3f1e88f20f6e46109402f8c15d59bac37\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3cfaac77b3c32ac3940df28866de263c3f45d24c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/633cadbc0b8323f5cc140a285d2432089dbb534e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/83f9fb561c1c3917e19f95523dd933c7d30291aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/89038cc87d80c77e7aa6f42a64b2573b74af339f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9d1fcd64ab81200e02b7a6db5eb1da8e244e8289\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/af28d801cd2db4cc7378554499bd4a5d84a5517e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T14:18:54+00:00",
      "cve": "CVE-2026-72069",
      "id": "CVE-2026-72069",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72069.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.