CVE-2026-89485 (GCVE-0-2026-89485)
Vulnerability from cvelistv5 – Published: 2026-09-11 19:43 – Updated: 2026-10-19 08:47
VLAI
EPSS
VEX
Title
lockd: pin next file across nlm_inspect_file lock-drop
Summary
In the Linux kernel, the following vulnerability has been resolved:
lockd: pin next file across nlm_inspect_file lock-drop
nlm_traverse_files() pins the current file with f_count++ across
a mutex_unlock for nlm_inspect_file(), but nothing pins the saved
next pointer. A concurrent nlm_release_file() can kfree the next
file during the unlock window, and the iterator dereferences freed
memory on the next loop step.
Pin both current and next before the lock-drop. Advance by
swapping the pinned cursors at the end of each iteration so next
is always held alive across the unlock.
Always call nlm_file_release() after dropping the iteration pin,
regardless of whether the file matched the predicate. Use
nlm_file_inuse(), which does a live walk of the inode lock list,
rather than the cached f_locks field, so skipped files that never
ran nlm_inspect_file() are evaluated correctly.
Because every file in a hash bucket is now pinned and released,
files skipped by the is_failover_file predicate that have no
locks, blocks, shares, or external references are deleted during
traversal. The old code never evaluated skipped files for
cleanup. The new behavior is intentional: such files are stale
and should not persist in the table.
Severity
9.8 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
01df9c5e918ae5559f2d96da0143f8bfbb9e6171 , < e3c413f789eaf0170275c7eba523ead73d963f30
(git)
Affected: 01df9c5e918ae5559f2d96da0143f8bfbb9e6171 , < 08a455f87b14c7ff22ae3fdadda62a796a3a5572 (git) Affected: 01df9c5e918ae5559f2d96da0143f8bfbb9e6171 , < 550c19222c7132c888e23c9d89079ba1c9bc4cca (git) Affected: 01df9c5e918ae5559f2d96da0143f8bfbb9e6171 , < 350087f231c11efcd288c310707c40eab63ca583 (git) Affected: 01df9c5e918ae5559f2d96da0143f8bfbb9e6171 , < c24bdb7df2f34bdc38ca8a73796f5acb40f1830c (git) Affected: 01df9c5e918ae5559f2d96da0143f8bfbb9e6171 , < 41f0a6d31615fcae261bf28a0aa50050dc93a401 (git) Affected: 01df9c5e918ae5559f2d96da0143f8bfbb9e6171 , < e999a88133654c6dfc68487fb49da5f20dfa2d4f (git) Affected: 01df9c5e918ae5559f2d96da0143f8bfbb9e6171 , < 526c49cff3f72c3ec74752016380c7567040581b (git) |
guessed | |
| Linux | Linux |
Affected:
2.6.18
Unaffected: 0 , < 2.6.18 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.109 , ≤ 6.12.* (semver) Unaffected: 6.18.50 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/lockd/svcsubs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e3c413f789eaf0170275c7eba523ead73d963f30",
"status": "affected",
"version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
"versionType": "git"
},
{
"lessThan": "08a455f87b14c7ff22ae3fdadda62a796a3a5572",
"status": "affected",
"version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
"versionType": "git"
},
{
"lessThan": "550c19222c7132c888e23c9d89079ba1c9bc4cca",
"status": "affected",
"version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
"versionType": "git"
},
{
"lessThan": "350087f231c11efcd288c310707c40eab63ca583",
"status": "affected",
"version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
"versionType": "git"
},
{
"lessThan": "c24bdb7df2f34bdc38ca8a73796f5acb40f1830c",
"status": "affected",
"version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
"versionType": "git"
},
{
"lessThan": "41f0a6d31615fcae261bf28a0aa50050dc93a401",
"status": "affected",
"version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
"versionType": "git"
},
{
"lessThan": "e999a88133654c6dfc68487fb49da5f20dfa2d4f",
"status": "affected",
"version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
"versionType": "git"
},
{
"lessThan": "526c49cff3f72c3ec74752016380c7567040581b",
"status": "affected",
"version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/lockd/svcsubs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"lessThan": "2.6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlockd: pin next file across nlm_inspect_file lock-drop\n\nnlm_traverse_files() pins the current file with f_count++ across\na mutex_unlock for nlm_inspect_file(), but nothing pins the saved\nnext pointer. A concurrent nlm_release_file() can kfree the next\nfile during the unlock window, and the iterator dereferences freed\nmemory on the next loop step.\n\nPin both current and next before the lock-drop. Advance by\nswapping the pinned cursors at the end of each iteration so next\nis always held alive across the unlock.\n\nAlways call nlm_file_release() after dropping the iteration pin,\nregardless of whether the file matched the predicate. Use\nnlm_file_inuse(), which does a live walk of the inode lock list,\nrather than the cached f_locks field, so skipped files that never\nran nlm_inspect_file() are evaluated correctly.\n\nBecause every file in a hash bucket is now pinned and released,\nfiles skipped by the is_failover_file predicate that have no\nlocks, blocks, shares, or external references are deleted during\ntraversal. The old code never evaluated skipped files for\ncleanup. The new behavior is intentional: such files are stale\nand should not persist in the table."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - lockd is the in-kernel NLM RPC server on TCP/UDP, reached by remote NFSv3 clients. nlm_traverse_files() runs on NLMPROC_FREE_ALL, and nlm_release_file() runs from LOCK/UNLOCK/TEST and from rpciod NLM_GRANTED_MSG completion, so the UAF is triggered by network NLM traffic.\nAC:L - A remote NFS client can populate nlm_files via LOCK, send FREE_ALL to drop nlm_file_mutex inside nlm_traverse_files(), and concurrently complete in-flight GRANTED_MSG callbacks so rpciod\u0027s nlmsvc_grant_release() calls nlm_release_file() on the unpinned next object; the attacker drives both sides of the race.\nPR:N - lockd_authenticate() accepts RPC_AUTH_NULL and RPC_AUTH_UNIX. FREE_ALL is not a privileged-port callback, and nlm_fopen() opens files with NFSD_MAY_BYPASS_GSS|NFSD_MAY_NLM, so no host account or capability is required.\nUI:N - Exploitation uses only attacker-sent NLM RPCs (LOCK/FREE_ALL and grant-callback completion); no victim user or administrator action is required.\nS:U - The use-after-free is in the host kernel\u0027s lockd file table and impacts that same kernel; it does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - The iterator dereferences a kfree\u0027d struct nlm_file (list pointers, f_file[], f_count). This UAF lets an attacker reuse the slab object and obtain a kernel read primitive, so confidentiality impact is high.\nI:H - The same nlm_file UAF is a kernel heap free of list nodes, mutex state, and struct file pointers, which can be sprayed for an arbitrary write and control-flow hijack, so integrity impact is high.\nA:H - Walking the freed nlm_file in nlm_traverse_files() causes a kernel oops/panic (KASAN slab-use-after-free), so availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:47:35.868Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e3c413f789eaf0170275c7eba523ead73d963f30"
},
{
"url": "https://git.kernel.org/stable/c/08a455f87b14c7ff22ae3fdadda62a796a3a5572"
},
{
"url": "https://git.kernel.org/stable/c/550c19222c7132c888e23c9d89079ba1c9bc4cca"
},
{
"url": "https://git.kernel.org/stable/c/350087f231c11efcd288c310707c40eab63ca583"
},
{
"url": "https://git.kernel.org/stable/c/c24bdb7df2f34bdc38ca8a73796f5acb40f1830c"
},
{
"url": "https://git.kernel.org/stable/c/41f0a6d31615fcae261bf28a0aa50050dc93a401"
},
{
"url": "https://git.kernel.org/stable/c/e999a88133654c6dfc68487fb49da5f20dfa2d4f"
},
{
"url": "https://git.kernel.org/stable/c/526c49cff3f72c3ec74752016380c7567040581b"
}
],
"title": "lockd: pin next file across nlm_inspect_file lock-drop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89485",
"datePublished": "2026-09-11T19:43:39.403Z",
"dateReserved": "2026-09-11T19:38:34.712Z",
"dateUpdated": "2026-10-19T08:47:35.868Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-89485",
"date": "2026-11-09",
"epss": "0.00714",
"percentile": "0.53953"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/lockd/svcsubs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e3c413f789eaf0170275c7eba523ead73d963f30",
"status": "affected",
"version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
"versionType": "git"
},
{
"lessThan": "08a455f87b14c7ff22ae3fdadda62a796a3a5572",
"status": "affected",
"version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
"versionType": "git"
},
{
"lessThan": "550c19222c7132c888e23c9d89079ba1c9bc4cca",
"status": "affected",
"version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
"versionType": "git"
},
{
"lessThan": "350087f231c11efcd288c310707c40eab63ca583",
"status": "affected",
"version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
"versionType": "git"
},
{
"lessThan": "c24bdb7df2f34bdc38ca8a73796f5acb40f1830c",
"status": "affected",
"version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
"versionType": "git"
},
{
"lessThan": "41f0a6d31615fcae261bf28a0aa50050dc93a401",
"status": "affected",
"version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
"versionType": "git"
},
{
"lessThan": "e999a88133654c6dfc68487fb49da5f20dfa2d4f",
"status": "affected",
"version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
"versionType": "git"
},
{
"lessThan": "526c49cff3f72c3ec74752016380c7567040581b",
"status": "affected",
"version": "01df9c5e918ae5559f2d96da0143f8bfbb9e6171",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/lockd/svcsubs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"lessThan": "2.6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlockd: pin next file across nlm_inspect_file lock-drop\n\nnlm_traverse_files() pins the current file with f_count++ across\na mutex_unlock for nlm_inspect_file(), but nothing pins the saved\nnext pointer. A concurrent nlm_release_file() can kfree the next\nfile during the unlock window, and the iterator dereferences freed\nmemory on the next loop step.\n\nPin both current and next before the lock-drop. Advance by\nswapping the pinned cursors at the end of each iteration so next\nis always held alive across the unlock.\n\nAlways call nlm_file_release() after dropping the iteration pin,\nregardless of whether the file matched the predicate. Use\nnlm_file_inuse(), which does a live walk of the inode lock list,\nrather than the cached f_locks field, so skipped files that never\nran nlm_inspect_file() are evaluated correctly.\n\nBecause every file in a hash bucket is now pinned and released,\nfiles skipped by the is_failover_file predicate that have no\nlocks, blocks, shares, or external references are deleted during\ntraversal. The old code never evaluated skipped files for\ncleanup. The new behavior is intentional: such files are stale\nand should not persist in the table."
}
],
"id": "CVE-2026-89485",
"lastModified": "2026-10-19T09:17:42.023",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-09-11T20:19:30.173",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/08a455f87b14c7ff22ae3fdadda62a796a3a5572"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/350087f231c11efcd288c310707c40eab63ca583"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/41f0a6d31615fcae261bf28a0aa50050dc93a401"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/526c49cff3f72c3ec74752016380c7567040581b"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/550c19222c7132c888e23c9d89079ba1c9bc4cca"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/c24bdb7df2f34bdc38ca8a73796f5acb40f1830c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/e3c413f789eaf0170275c7eba523ead73d963f30"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/e999a88133654c6dfc68487fb49da5f20dfa2d4f"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-11-06T01:16:06+00:00",
"cve": "CVE-2026-89485",
"id": "CVE-2026-89485",
"initial_release_date": "2026-09-11T00:00:00+00:00",
"product_status:known_affected": "112",
"product_status:known_not_affected": "91",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: lockd: pin next file across nlm_inspect_file lock-drop",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89485.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.