CVE-2026-97991 (GCVE-0-2026-97991)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:23 – Updated: 2026-10-19 09:11
VLAI
EPSS
VEX
Title
vdpa_sim_blk: reject out-of-range sector starts
Summary
In the Linux kernel, the following vulnerability has been resolved:
vdpa_sim_blk: reject out-of-range sector starts
vdpasim_blk_check_range() logs an invalid start sector but continues
validating the request. The subsequent unsigned capacity subtraction can
underflow and let an out-of-range buffer offset reach the data path.
The invalid offset is used by three request paths. VIRTIO_BLK_T_OUT
copies guest data to blk->buffer + offset through
vringh_iov_pull_iotlb(), causing an out-of-bounds write in
_copy_from_iter() or memcpy(). VIRTIO_BLK_T_IN copies from
blk->buffer + offset to the guest through vringh_iov_push_iotlb(),
causing an out-of-bounds read in _copy_to_iter().
VIRTIO_BLK_T_WRITE_ZEROES passes blk->buffer + offset to memset(),
causing an out-of-bounds write.
Reject starts at or beyond the capacity before the subtraction. Treat the
capacity boundary as invalid because the IN and OUT paths round byte counts
down to sectors for validation but later copy the original byte counts. A
sub-sector request at the capacity boundary would otherwise still access
past the end of the buffer.
I found this bug myself, though the patch was written with AI assistance.
Severity
7.8 (High)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
7d189f617f83f780915b737896a696ff605bd19f , < 2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018
(git)
Affected: 7d189f617f83f780915b737896a696ff605bd19f , < 36ef4d8527f71648f00347f6ba759f0b7e5e0977 (git) Affected: 7d189f617f83f780915b737896a696ff605bd19f , < 000c6300776ceaf6b715780113f4275b1be4195b (git) Affected: 7d189f617f83f780915b737896a696ff605bd19f , < 14acb0d44b7d90a077beb7b92b444b90bafda9d9 (git) Affected: 7d189f617f83f780915b737896a696ff605bd19f , < a8a1413a2cfdbedc896249f461d6d92efbbfe21f (git) Affected: 7d189f617f83f780915b737896a696ff605bd19f , < d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf (git) Affected: 7d189f617f83f780915b737896a696ff605bd19f , < 0a8693f00c408d85f086ad85d29e7030bf1e2055 (git) |
guessed | |
| Linux | Linux |
Affected:
5.13
Unaffected: 0 , < 5.13 (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018",
"status": "affected",
"version": "7d189f617f83f780915b737896a696ff605bd19f",
"versionType": "git"
},
{
"lessThan": "36ef4d8527f71648f00347f6ba759f0b7e5e0977",
"status": "affected",
"version": "7d189f617f83f780915b737896a696ff605bd19f",
"versionType": "git"
},
{
"lessThan": "000c6300776ceaf6b715780113f4275b1be4195b",
"status": "affected",
"version": "7d189f617f83f780915b737896a696ff605bd19f",
"versionType": "git"
},
{
"lessThan": "14acb0d44b7d90a077beb7b92b444b90bafda9d9",
"status": "affected",
"version": "7d189f617f83f780915b737896a696ff605bd19f",
"versionType": "git"
},
{
"lessThan": "a8a1413a2cfdbedc896249f461d6d92efbbfe21f",
"status": "affected",
"version": "7d189f617f83f780915b737896a696ff605bd19f",
"versionType": "git"
},
{
"lessThan": "d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf",
"status": "affected",
"version": "7d189f617f83f780915b737896a696ff605bd19f",
"versionType": "git"
},
{
"lessThan": "0a8693f00c408d85f086ad85d29e7030bf1e2055",
"status": "affected",
"version": "7d189f617f83f780915b737896a696ff605bd19f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim_blk: reject out-of-range sector starts\n\nvdpasim_blk_check_range() logs an invalid start sector but continues\nvalidating the request. The subsequent unsigned capacity subtraction can\nunderflow and let an out-of-range buffer offset reach the data path.\n\nThe invalid offset is used by three request paths. VIRTIO_BLK_T_OUT\ncopies guest data to blk-\u003ebuffer + offset through\nvringh_iov_pull_iotlb(), causing an out-of-bounds write in\n_copy_from_iter() or memcpy(). VIRTIO_BLK_T_IN copies from\nblk-\u003ebuffer + offset to the guest through vringh_iov_push_iotlb(),\ncausing an out-of-bounds read in _copy_to_iter().\nVIRTIO_BLK_T_WRITE_ZEROES passes blk-\u003ebuffer + offset to memset(),\ncausing an out-of-bounds write.\n\nReject starts at or beyond the capacity before the subtraction. Treat the\ncapacity boundary as invalid because the IN and OUT paths round byte counts\ndown to sectors for validation but later copy the original byte counts. A\nsub-sector request at the capacity boundary would otherwise still access\npast the end of the buffer.\n\nI found this bug myself, though the patch was written with AI assistance."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bad value is virtio_blk_outhdr.sector, written into the virtqueue by the virtio driver. That driver is a guest VM using the device through vhost-vdpa, or a local process with access to /dev/vhost-vdpa-N. vdpasim_blk_handle_req() reads it with vringh_getdesc_iotlb()/vringh_iov_pull_iotlb(). No network protocol carries it.\nAC:H - The code needs a vdpa_sim_blk device, a test simulator that root must create with VDPA_CMD_DEV_NEW (GENL_ADMIN_PERM) and bind to vhost-vdpa for a VM. The attacker cannot set that up. Once it exists, a single request with a large sector fires the bug every time.\nPR:L - The attacker needs control of the virtqueue driver, for example the guest kernel of a VM that was given the device, or a user granted the vhost-vdpa char device. That is ordinary tenant privilege, not host root.\nUI:N - Once the device is assigned, the attacker posts the request on their own virtqueue and the simulator\u0027s work function runs vdpasim_blk_handle_req() with no host-side action.\nS:C - The driver of the device (usually a guest VM) corrupts or reads host kernel memory outside blk-\u003ebuffer. That crosses from the guest\u0027s authority into the host kernel\u0027s, a guest-to-host boundary.\nC:H - VIRTIO_BLK_T_IN with an out-of-range sector makes vringh_iov_push_iotlb() copy from blk-\u003ebuffer + (sector \u003c\u003c 9). The attacker picks that offset from the kvzalloc buffer, and the host kernel memory is returned into the attacker\u0027s own descriptors.\nI:H - VIRTIO_BLK_T_OUT makes vringh_iov_pull_iotlb() copy attacker data to blk-\u003ebuffer + offset, and WRITE_ZEROES memsets there. The offset is under attacker control, which gives a write into host kernel memory that can lead to code execution.\nA:H - A write or read at a wild offset hits unmapped or critical host memory and oopses or panics the host kernel. That also takes down every other VM on the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:11:58.242Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018"
},
{
"url": "https://git.kernel.org/stable/c/36ef4d8527f71648f00347f6ba759f0b7e5e0977"
},
{
"url": "https://git.kernel.org/stable/c/000c6300776ceaf6b715780113f4275b1be4195b"
},
{
"url": "https://git.kernel.org/stable/c/14acb0d44b7d90a077beb7b92b444b90bafda9d9"
},
{
"url": "https://git.kernel.org/stable/c/a8a1413a2cfdbedc896249f461d6d92efbbfe21f"
},
{
"url": "https://git.kernel.org/stable/c/d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf"
},
{
"url": "https://git.kernel.org/stable/c/0a8693f00c408d85f086ad85d29e7030bf1e2055"
}
],
"title": "vdpa_sim_blk: reject out-of-range sector starts",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97991",
"datePublished": "2026-09-25T10:23:23.863Z",
"dateReserved": "2026-09-25T10:18:58.209Z",
"dateUpdated": "2026-10-19T09:11:58.242Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-97991",
"date": "2026-11-14",
"epss": "0.00122",
"percentile": "0.02003"
},
"microsoft_vex": {
"current_release_date": "2026-10-21T18:40:01.000Z",
"cve": "CVE-2026-97991",
"id": "msrc_CVE-2026-97991",
"initial_release_date": "2026-09-28T02:00:38.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"product_status:under_investigation": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "vdpa_sim_blk: reject out-of-range sector starts",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-97991.json",
"version": "4"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018",
"status": "affected",
"version": "7d189f617f83f780915b737896a696ff605bd19f",
"versionType": "git"
},
{
"lessThan": "36ef4d8527f71648f00347f6ba759f0b7e5e0977",
"status": "affected",
"version": "7d189f617f83f780915b737896a696ff605bd19f",
"versionType": "git"
},
{
"lessThan": "000c6300776ceaf6b715780113f4275b1be4195b",
"status": "affected",
"version": "7d189f617f83f780915b737896a696ff605bd19f",
"versionType": "git"
},
{
"lessThan": "14acb0d44b7d90a077beb7b92b444b90bafda9d9",
"status": "affected",
"version": "7d189f617f83f780915b737896a696ff605bd19f",
"versionType": "git"
},
{
"lessThan": "a8a1413a2cfdbedc896249f461d6d92efbbfe21f",
"status": "affected",
"version": "7d189f617f83f780915b737896a696ff605bd19f",
"versionType": "git"
},
{
"lessThan": "d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf",
"status": "affected",
"version": "7d189f617f83f780915b737896a696ff605bd19f",
"versionType": "git"
},
{
"lessThan": "0a8693f00c408d85f086ad85d29e7030bf1e2055",
"status": "affected",
"version": "7d189f617f83f780915b737896a696ff605bd19f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim_blk: reject out-of-range sector starts\n\nvdpasim_blk_check_range() logs an invalid start sector but continues\nvalidating the request. The subsequent unsigned capacity subtraction can\nunderflow and let an out-of-range buffer offset reach the data path.\n\nThe invalid offset is used by three request paths. VIRTIO_BLK_T_OUT\ncopies guest data to blk-\u003ebuffer + offset through\nvringh_iov_pull_iotlb(), causing an out-of-bounds write in\n_copy_from_iter() or memcpy(). VIRTIO_BLK_T_IN copies from\nblk-\u003ebuffer + offset to the guest through vringh_iov_push_iotlb(),\ncausing an out-of-bounds read in _copy_to_iter().\nVIRTIO_BLK_T_WRITE_ZEROES passes blk-\u003ebuffer + offset to memset(),\ncausing an out-of-bounds write.\n\nReject starts at or beyond the capacity before the subtraction. Treat the\ncapacity boundary as invalid because the IN and OUT paths round byte counts\ndown to sectors for validation but later copy the original byte counts. A\nsub-sector request at the capacity boundary would otherwise still access\npast the end of the buffer.\n\nI found this bug myself, though the patch was written with AI assistance."
}
],
"id": "CVE-2026-97991",
"lastModified": "2026-10-19T10:17:50.470",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.1,
"impactScore": 6.0,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-09-25T11:17:27.220",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/000c6300776ceaf6b715780113f4275b1be4195b"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/0a8693f00c408d85f086ad85d29e7030bf1e2055"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/14acb0d44b7d90a077beb7b92b444b90bafda9d9"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/36ef4d8527f71648f00347f6ba759f0b7e5e0977"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a8a1413a2cfdbedc896249f461d6d92efbbfe21f"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-11-06T02:38:42+00:00",
"cve": "CVE-2026-97991",
"id": "CVE-2026-97991",
"initial_release_date": "2026-09-25T00:00:00+00:00",
"product_status:known_affected": "158",
"product_status:known_not_affected": "42",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: vdpa_sim_blk: reject out-of-range sector starts",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97991.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.