CVE-2026-93228 (GCVE-0-2026-93228)

Vulnerability from cvelistv5 – Published: 2026-09-24 15:29 – Updated: 2026-10-30 12:36
VLAI
Title
svcrdma: Reject Write/Reply chunks with segcount 0
Summary
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdr_check_write_chunk() only rejects segcount > rc_maxpages, so zero passes the range check, and xdr_inline_decode(stream, 0) returns the current (non-NULL) cursor without advancing. The function returns true and pcl_alloc_write() then links a struct svc_rdma_chunk with ch_segcount == 0 onto rc_write_pcl or rc_reply_pcl. An earlier patch in this series made pcl_for_each_segment() safe for ch_segcount == 0, so this no longer drives the memory walk it used to. Rejecting the malformed frame at the decode boundary is still worthwhile as defense in depth: it keeps degenerate zero-segment chunks off the parsed chunk lists entirely, so any future consumer that walks ch_segments directly cannot observe one, and it makes the zero-floor easy to backport to trees where the macro change is more intrusive. RFC 8166 has no meaning for a Write/Reply chunk that describes no remote buffer, so no legitimate client is affected. xdr_check_reply_chunk() funnels Reply chunks through xdr_check_write_chunk() and inherits the same rejection. pcl_alloc_write() also links each chunk onto the parsed chunk list before filling its segment array. If a future change weakens the segcount-0 rejection, an incomplete chunk is visible to consumers during the fill loop. Reorder so that list_add_tail() follows the segment fill loop, ensuring only fully-populated chunks appear on the list.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6642 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 , < ac730b8cbaeec6831116e1455d909ecbdcdcbd34 (git)
Affected: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 , < 28c5a3a572f6cf81ac304459cfd515480995d62a (git)
Affected: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 , < fe533ae1bed2ef2b3d54ee7ab410da1874ed3d4f (git)
Affected: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 , < a798714b58041e88716db3bf8fb03ae13eecd54a (git)
Affected: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 , < 45dbdb2637b7fc5f1355b588780d2a7fb0516805 (git)
Affected: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 , < 9808eb7656666acc7291bae9ab6b987bd16e47e0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 6.1.191 , ≤ 6.1.* (semver)
Unaffected: 6.6.160 , ≤ 6.6.* (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_pcl.c",
            "net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ac730b8cbaeec6831116e1455d909ecbdcdcbd34",
              "status": "affected",
              "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
              "versionType": "git"
            },
            {
              "lessThan": "28c5a3a572f6cf81ac304459cfd515480995d62a",
              "status": "affected",
              "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
              "versionType": "git"
            },
            {
              "lessThan": "fe533ae1bed2ef2b3d54ee7ab410da1874ed3d4f",
              "status": "affected",
              "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
              "versionType": "git"
            },
            {
              "lessThan": "a798714b58041e88716db3bf8fb03ae13eecd54a",
              "status": "affected",
              "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
              "versionType": "git"
            },
            {
              "lessThan": "45dbdb2637b7fc5f1355b588780d2a7fb0516805",
              "status": "affected",
              "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
              "versionType": "git"
            },
            {
              "lessThan": "9808eb7656666acc7291bae9ab6b987bd16e47e0",
              "status": "affected",
              "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_pcl.c",
            "net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject Write/Reply chunks with segcount 0\n\nA peer can send a Write or Reply chunk whose segcount field is zero.\nxdr_check_write_chunk() only rejects segcount \u003e rc_maxpages, so zero\npasses the range check, and xdr_inline_decode(stream, 0) returns the\ncurrent (non-NULL) cursor without advancing. The function returns\ntrue and pcl_alloc_write() then links a struct svc_rdma_chunk with\nch_segcount == 0 onto rc_write_pcl or rc_reply_pcl.\n\nAn earlier patch in this series made pcl_for_each_segment() safe for\nch_segcount == 0, so this no longer drives the memory walk it used\nto. Rejecting the malformed frame at the decode boundary is still\nworthwhile as defense in depth: it keeps degenerate zero-segment\nchunks off the parsed chunk lists entirely, so any future consumer\nthat walks ch_segments directly cannot observe one, and it makes the\nzero-floor easy to backport to trees where the macro change is more\nintrusive. RFC 8166 has no meaning for a Write/Reply chunk that\ndescribes no remote buffer, so no legitimate client is affected.\n\nxdr_check_reply_chunk() funnels Reply chunks through\nxdr_check_write_chunk() and inherits the same rejection.\n\npcl_alloc_write() also links each chunk onto the parsed chunk list\nbefore filling its segment array. If a future change weakens the\nsegcount-0 rejection, an incomplete chunk is visible to consumers\nduring the fill loop. Reorder so that list_add_tail() follows the\nsegment fill loop, ensuring only fully-populated chunks appear on\nthe list."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote NFS/RDMA peer places a Write or Reply chunk with segcount 0 in the RPC-over-RDMA transport header; svc_rdma_recvfrom() \u2192 svc_rdma_xdr_decode_req() \u2192 xdr_check_write_list()/xdr_check_reply_chunk() \u2192 xdr_check_write_chunk() accepted that field over iWARP or routable RoCEv2.\nAC:L - The attacker sets RPCRDMA_CMP_F_SND_W_INV_OK in the RDMA-CM private connect blob (svc_rdma_parse_connect_private) and sends a Write/Reply chunk with segcount 0; xdr_check_write_chunk() only rejected segcount \u003e rc_maxpages, xdr_inline_decode(0) returns the cursor, and pcl_alloc_write() links a ch_segcount==0 chunk with no race.\nPR:N - xdr_check_write_chunk() and pcl_alloc_write() run in svc_rdma_xdr_decode_req() from svc_rdma_recvfrom() while parsing the transport header, before svc_xprt_do_recv() calls svc_process()/svc_authenticate(); RDMA CM accept performs no NFS credential check.\nUI:N - The attacker only needs to connect to a listening NFS/RDMA service and send an RPC-over-RDMA Call whose Write list or Reply chunk has segcount 0; no victim mount, click, or other user action is required.\nS:U - pcl_alloc_write() installs the empty chunk on the host kernel rc_write_pcl/rc_reply_pcl, and the subsequent heap walk and general protection fault stay inside nfsd\u0027s RPC-over-RDMA server; this is not a VM, IOMMU, or sandbox escape.\nC:H - Accepting segcount 0 in xdr_check_write_chunk() lets pcl_alloc_write() put a ch_segcount==0 Write/Reply chunk on the parsed list; pcl_for_each_segment then uses \u0026ch_segments[0u-1u] and walks adjacent kernel heap at sizeof(struct svc_rdma_segment) stride, an unbounded out-of-bounds read.\nI:N - svc_rdma_get_inv_rkey() only loads segment-\u003ers_handle from the overrun pointer to choose an invalidate rkey; Write/Reply encode and RDMA Write paths index with segno \u003c ch_segcount and skip or return -E2BIG on an empty chunk, so there is no out-of-bounds write or control-flow hijack.\nA:H - The underflowed pcl_for_each_segment walk of the empty Write/Reply chunk continues until it hits unmapped memory and raises a general protection fault, oopsing or panicking the kernel, and the peer can send another zero-segcount Call to repeat it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:36:26.967Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ac730b8cbaeec6831116e1455d909ecbdcdcbd34"
        },
        {
          "url": "https://git.kernel.org/stable/c/28c5a3a572f6cf81ac304459cfd515480995d62a"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe533ae1bed2ef2b3d54ee7ab410da1874ed3d4f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a798714b58041e88716db3bf8fb03ae13eecd54a"
        },
        {
          "url": "https://git.kernel.org/stable/c/45dbdb2637b7fc5f1355b588780d2a7fb0516805"
        },
        {
          "url": "https://git.kernel.org/stable/c/9808eb7656666acc7291bae9ab6b987bd16e47e0"
        }
      ],
      "title": "svcrdma: Reject Write/Reply chunks with segcount 0",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93228",
    "datePublished": "2026-09-24T15:29:10.087Z",
    "dateReserved": "2026-09-17T16:02:15.094Z",
    "dateUpdated": "2026-10-30T12:36:26.967Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93228",
      "date": "2026-11-10",
      "epss": "0.00501",
      "percentile": "0.43273"
    },
    "microsoft_vex": {
      "current_release_date": "2026-11-07T01:48:06.000Z",
      "cve": "CVE-2026-93228",
      "id": "msrc_CVE-2026-93228",
      "initial_release_date": "2026-09-27T23:15:12.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "svcrdma: Reject Write/Reply chunks with segcount 0",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-93228.json",
      "version": "5"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/xprtrdma/svc_rdma_pcl.c",
                  "net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ac730b8cbaeec6831116e1455d909ecbdcdcbd34",
                    "status": "affected",
                    "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "28c5a3a572f6cf81ac304459cfd515480995d62a",
                    "status": "affected",
                    "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fe533ae1bed2ef2b3d54ee7ab410da1874ed3d4f",
                    "status": "affected",
                    "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a798714b58041e88716db3bf8fb03ae13eecd54a",
                    "status": "affected",
                    "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "45dbdb2637b7fc5f1355b588780d2a7fb0516805",
                    "status": "affected",
                    "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9808eb7656666acc7291bae9ab6b987bd16e47e0",
                    "status": "affected",
                    "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/xprtrdma/svc_rdma_pcl.c",
                  "net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.11"
                  },
                  {
                    "lessThan": "5.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.191",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.160",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject Write/Reply chunks with segcount 0\n\nA peer can send a Write or Reply chunk whose segcount field is zero.\nxdr_check_write_chunk() only rejects segcount \u003e rc_maxpages, so zero\npasses the range check, and xdr_inline_decode(stream, 0) returns the\ncurrent (non-NULL) cursor without advancing. The function returns\ntrue and pcl_alloc_write() then links a struct svc_rdma_chunk with\nch_segcount == 0 onto rc_write_pcl or rc_reply_pcl.\n\nAn earlier patch in this series made pcl_for_each_segment() safe for\nch_segcount == 0, so this no longer drives the memory walk it used\nto. Rejecting the malformed frame at the decode boundary is still\nworthwhile as defense in depth: it keeps degenerate zero-segment\nchunks off the parsed chunk lists entirely, so any future consumer\nthat walks ch_segments directly cannot observe one, and it makes the\nzero-floor easy to backport to trees where the macro change is more\nintrusive. RFC 8166 has no meaning for a Write/Reply chunk that\ndescribes no remote buffer, so no legitimate client is affected.\n\nxdr_check_reply_chunk() funnels Reply chunks through\nxdr_check_write_chunk() and inherits the same rejection.\n\npcl_alloc_write() also links each chunk onto the parsed chunk list\nbefore filling its segment array. If a future change weakens the\nsegcount-0 rejection, an incomplete chunk is visible to consumers\nduring the fill loop. Reorder so that list_add_tail() follows the\nsegment fill loop, ensuring only fully-populated chunks appear on\nthe list."
          }
        ],
        "id": "CVE-2026-93228",
        "lastModified": "2026-10-30T13:21:00.657",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-24T16:17:18.253",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/28c5a3a572f6cf81ac304459cfd515480995d62a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/45dbdb2637b7fc5f1355b588780d2a7fb0516805"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9808eb7656666acc7291bae9ab6b987bd16e47e0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a798714b58041e88716db3bf8fb03ae13eecd54a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ac730b8cbaeec6831116e1455d909ecbdcdcbd34"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fe533ae1bed2ef2b3d54ee7ab410da1874ed3d4f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-11T12:01:41+00:00",
      "cve": "CVE-2026-93228",
      "id": "CVE-2026-93228",
      "initial_release_date": "2026-09-24T00:00:00+00:00",
      "product_status:fixed": "1143",
      "product_status:known_affected": "38",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: svcrdma: Reject Write/Reply chunks with segcount 0",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93228.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.