CVE-2026-74666 (GCVE-0-2026-74666)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-27 12:40
VLAI
Title
packet: synchronize pressure clearing with ring reconfiguration
Summary
In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packet_set_ring() updates the RX ring state under sk_receive_queue.lock, but used to publish the tpacket receive mode through po->prot_hook.func after releasing that lock. packet_poll() and packet_recvmsg() can then run the pressure clearing path after the ring has been cleared while still seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference stale or NULL ring storage. Move the existing receive hook assignment into the same sk_receive_queue.lock section as the ring state update. Keep the assignment otherwise unchanged, including on TX ring reconfiguration, to avoid adding behavior changes that are not required for the fix. Serialize packet_recvmsg() pressure clearing with the same queue lock only after PACKET_SOCK_PRESSURE has been observed. If the flag is clear and the socket has moved away from tpacket_rcv, packet_set_ring() has already detached the socket and waited for synchronize_net(), so no new packet input can set the flag again. packet_poll() already holds sk_receive_queue.lock, so it uses the new unlocked helper directly.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2ccdbaa6d55b0656244ba57c4b56765a0af76c0a , < bf3c8e86bc8ad111be3f3136125e255344bcb3da (git)
Affected: 2ccdbaa6d55b0656244ba57c4b56765a0af76c0a , < 8cfb2e71926a682f36c4240067d424074dd8f70f (git)
Affected: 2ccdbaa6d55b0656244ba57c4b56765a0af76c0a , < f015c9de92b731814059a343b765c60c0196225c (git)
Affected: 2ccdbaa6d55b0656244ba57c4b56765a0af76c0a , < cf8189b82bb93f219ab740e0346c919ad65ada62 (git)
Affected: 2ccdbaa6d55b0656244ba57c4b56765a0af76c0a , < ad740b4990347521f0db260d381f9f74e7b340ba (git)
Affected: 2ccdbaa6d55b0656244ba57c4b56765a0af76c0a , < 2c7b5eb87b2b288cdbde825f21d2b83b2f5da747 (git)
Affected: 2ccdbaa6d55b0656244ba57c4b56765a0af76c0a , < a08196c3cc105947746ec21309edfbb60275fcdb (git)
Affected: 2ccdbaa6d55b0656244ba57c4b56765a0af76c0a , < 1a35da325cac4d5bcad76a2aa943408a6f1d9000 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 5.10.267 , ≤ 5.10.* (semver)
Unaffected: 5.15.218 , ≤ 5.15.* (semver)
Unaffected: 6.1.185 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bf3c8e86bc8ad111be3f3136125e255344bcb3da",
              "status": "affected",
              "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a",
              "versionType": "git"
            },
            {
              "lessThan": "8cfb2e71926a682f36c4240067d424074dd8f70f",
              "status": "affected",
              "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a",
              "versionType": "git"
            },
            {
              "lessThan": "f015c9de92b731814059a343b765c60c0196225c",
              "status": "affected",
              "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a",
              "versionType": "git"
            },
            {
              "lessThan": "cf8189b82bb93f219ab740e0346c919ad65ada62",
              "status": "affected",
              "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a",
              "versionType": "git"
            },
            {
              "lessThan": "ad740b4990347521f0db260d381f9f74e7b340ba",
              "status": "affected",
              "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a",
              "versionType": "git"
            },
            {
              "lessThan": "2c7b5eb87b2b288cdbde825f21d2b83b2f5da747",
              "status": "affected",
              "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a",
              "versionType": "git"
            },
            {
              "lessThan": "a08196c3cc105947746ec21309edfbb60275fcdb",
              "status": "affected",
              "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a",
              "versionType": "git"
            },
            {
              "lessThan": "1a35da325cac4d5bcad76a2aa943408a6f1d9000",
              "status": "affected",
              "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.267",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: synchronize pressure clearing with ring reconfiguration\n\npacket_set_ring() updates the RX ring state under sk_receive_queue.lock,\nbut used to publish the tpacket receive mode through po-\u003eprot_hook.func\nafter releasing that lock. packet_poll() and packet_recvmsg() can then\nrun the pressure clearing path after the ring has been cleared while\nstill seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference\nstale or NULL ring storage.\n\nMove the existing receive hook assignment into the same\nsk_receive_queue.lock section as the ring state update. Keep the\nassignment otherwise unchanged, including on TX ring reconfiguration, to\navoid adding behavior changes that are not required for the fix.\n\nSerialize packet_recvmsg() pressure clearing with the same queue lock\nonly after PACKET_SOCK_PRESSURE has been observed. If the flag is clear\nand the socket has moved away from tpacket_rcv, packet_set_ring() has\nalready detached the socket and waited for synchronize_net(), so no new\npacket input can set the flag again.\n\npacket_poll() already holds sk_receive_queue.lock, so it uses the new\nunlocked helper directly."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is hit only from local AF_PACKET syscalls\u2014setsockopt(PACKET_RX_RING) racing poll(2)/recvmsg(2) pressure clearing in packet_poll()/packet_recvmsg()\u2014not from remote packet receive paths like ksmbd, nfsd, or the TCP/IP stack.\nAC:L - The attacker controls both race sides: one thread polls/recvmsg while PACKET_SOCK_PRESSURE is set, another tears down the RX ring via PACKET_RX_RING; packet_set_ring()\u0027s synchronize_net() window makes the stale tpacket_rcv vs NULL/freed pg_vec mismatch reliably winnable.\nPR:L - packet_create() requires ns_capable(net-\u003euser_ns, CAP_NET_RAW); unprivileged users obtain CAP_NET_RAW via user+network namespaces (unshare -Urn) or container defaults (Docker NET_RAW), without init-namespace root.\nUI:N - No victim action is required; the attacker creates the AF_PACKET socket, configures the mmap RX ring, fills it to set PACKET_SOCK_PRESSURE, and races ring teardown against its own poll/recvmsg calls.\nS:U - Stale/NULL ring dereferences corrupt kernel heap state on the same host; this is standard kernel memory corruption within one security authority, not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - __packet_rcv_has_room() follows tpacket_rcv and dereferences rb-\u003epg_vec or prb_bdqc block pointers after packet_set_ring() cleared/freed the ring, yielding NULL-dereference or use-after-free reads of ring metadata and mmap-backed pages.\nI:H - Freed ring storage and stale prb_bdqc/pkbdq pointers remain attacker-influenced through mmap and concurrent ring operations, providing a controllable kernel heap use-after-free write primitive typical of AF_PACKET ring reconfiguration races.\nA:H - NULL pg_vec indexing in packet_lookup_frame() or stale block access in prb_lookup_block() from the pressure-clearing path causes an immediate kernel oops/panic, giving any qualifying local attacker repeatable host-wide denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:40:00.544Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bf3c8e86bc8ad111be3f3136125e255344bcb3da"
        },
        {
          "url": "https://git.kernel.org/stable/c/8cfb2e71926a682f36c4240067d424074dd8f70f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f015c9de92b731814059a343b765c60c0196225c"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf8189b82bb93f219ab740e0346c919ad65ada62"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad740b4990347521f0db260d381f9f74e7b340ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c7b5eb87b2b288cdbde825f21d2b83b2f5da747"
        },
        {
          "url": "https://git.kernel.org/stable/c/a08196c3cc105947746ec21309edfbb60275fcdb"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a35da325cac4d5bcad76a2aa943408a6f1d9000"
        }
      ],
      "title": "packet: synchronize pressure clearing with ring reconfiguration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74666",
    "datePublished": "2026-08-22T15:32:38.098Z",
    "dateReserved": "2026-08-15T05:44:03.924Z",
    "dateUpdated": "2026-08-27T12:40:00.544Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74666",
      "date": "2026-08-29",
      "epss": "0.00129",
      "percentile": "0.02869"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:45:56.000Z",
      "cve": "CVE-2026-74666",
      "id": "msrc_CVE-2026-74666",
      "initial_release_date": "2026-08-24T01:12:21.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "packet: synchronize pressure clearing with ring reconfiguration",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74666.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74666\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:40.467\",\"lastModified\":\"2026-08-27T13:18:36.643\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npacket: synchronize pressure clearing with ring reconfiguration\\n\\npacket_set_ring() updates the RX ring state under sk_receive_queue.lock,\\nbut used to publish the tpacket receive mode through po-\u003eprot_hook.func\\nafter releasing that lock. packet_poll() and packet_recvmsg() can then\\nrun the pressure clearing path after the ring has been cleared while\\nstill seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference\\nstale or NULL ring storage.\\n\\nMove the existing receive hook assignment into the same\\nsk_receive_queue.lock section as the ring state update. Keep the\\nassignment otherwise unchanged, including on TX ring reconfiguration, to\\navoid adding behavior changes that are not required for the fix.\\n\\nSerialize packet_recvmsg() pressure clearing with the same queue lock\\nonly after PACKET_SOCK_PRESSURE has been observed. If the flag is clear\\nand the socket has moved away from tpacket_rcv, packet_set_ring() has\\nalready detached the socket and waited for synchronize_net(), so no new\\npacket input can set the flag again.\\n\\npacket_poll() already holds sk_receive_queue.lock, so it uses the new\\nunlocked helper directly.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/packet/af_packet.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2ccdbaa6d55b0656244ba57c4b56765a0af76c0a\",\"lessThan\":\"bf3c8e86bc8ad111be3f3136125e255344bcb3da\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ccdbaa6d55b0656244ba57c4b56765a0af76c0a\",\"lessThan\":\"8cfb2e71926a682f36c4240067d424074dd8f70f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ccdbaa6d55b0656244ba57c4b56765a0af76c0a\",\"lessThan\":\"f015c9de92b731814059a343b765c60c0196225c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ccdbaa6d55b0656244ba57c4b56765a0af76c0a\",\"lessThan\":\"cf8189b82bb93f219ab740e0346c919ad65ada62\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ccdbaa6d55b0656244ba57c4b56765a0af76c0a\",\"lessThan\":\"ad740b4990347521f0db260d381f9f74e7b340ba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ccdbaa6d55b0656244ba57c4b56765a0af76c0a\",\"lessThan\":\"2c7b5eb87b2b288cdbde825f21d2b83b2f5da747\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ccdbaa6d55b0656244ba57c4b56765a0af76c0a\",\"lessThan\":\"a08196c3cc105947746ec21309edfbb60275fcdb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ccdbaa6d55b0656244ba57c4b56765a0af76c0a\",\"lessThan\":\"1a35da325cac4d5bcad76a2aa943408a6f1d9000\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/packet/af_packet.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.267\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.218\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.185\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1a35da325cac4d5bcad76a2aa943408a6f1d9000\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2c7b5eb87b2b288cdbde825f21d2b83b2f5da747\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8cfb2e71926a682f36c4240067d424074dd8f70f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a08196c3cc105947746ec21309edfbb60275fcdb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ad740b4990347521f0db260d381f9f74e7b340ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bf3c8e86bc8ad111be3f3136125e255344bcb3da\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cf8189b82bb93f219ab740e0346c919ad65ada62\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f015c9de92b731814059a343b765c60c0196225c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:53:44+00:00",
      "cve": "CVE-2026-74666",
      "id": "CVE-2026-74666",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: packet: synchronize pressure clearing with ring reconfiguration",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74666.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.