Vulnerability-Lookup

FKIE_CVE-2025-40246

Vulnerability from fkie_nvd - Published: 2025-12-04 16:16 - Updated: 2026-10-19 19:10

Severity

Summary

In the Linux kernel, the following vulnerability has been resolved: xfs: fix out of bounds memory read error in symlink repair xfs/286 produced this report on my test fleet: ================================================================== BUG: KFENCE: out-of-bounds read in memcpy_orig+0x54/0x110 Out-of-bounds read at 0xffff88843fe9e038 (184B right of kfence-#184): memcpy_orig+0x54/0x110 xrep_symlink_salvage_inline+0xb3/0xf0 [xfs] xrep_symlink_salvage+0x100/0x110 [xfs] xrep_symlink+0x2e/0x80 [xfs] xrep_attempt+0x61/0x1f0 [xfs] xfs_scrub_metadata+0x34f/0x5c0 [xfs] xfs_ioc_scrubv_metadata+0x387/0x560 [xfs] xfs_file_ioctl+0xe23/0x10e0 [xfs] __x64_sys_ioctl+0x76/0xc0 do_syscall_64+0x4e/0x1e0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 kfence-#184: 0xffff88843fe9df80-0xffff88843fe9dfea, size=107, cache=kmalloc-128 allocated by task 3470 on cpu 1 at 263329.131592s (192823.508886s ago): xfs_init_local_fork+0x79/0xe0 [xfs] xfs_iformat_local+0xa4/0x170 [xfs] xfs_iformat_data_fork+0x148/0x180 [xfs] xfs_inode_from_disk+0x2cd/0x480 [xfs] xfs_iget+0x450/0xd60 [xfs] xfs_bulkstat_one_int+0x6b/0x510 [xfs] xfs_bulkstat_iwalk+0x1e/0x30 [xfs] xfs_iwalk_ag_recs+0xdf/0x150 [xfs] xfs_iwalk_run_callbacks+0xb9/0x190 [xfs] xfs_iwalk_ag+0x1dc/0x2f0 [xfs] xfs_iwalk_args.constprop.0+0x6a/0x120 [xfs] xfs_iwalk+0xa4/0xd0 [xfs] xfs_bulkstat+0xfa/0x170 [xfs] xfs_ioc_fsbulkstat.isra.0+0x13a/0x230 [xfs] xfs_file_ioctl+0xbf2/0x10e0 [xfs] __x64_sys_ioctl+0x76/0xc0 do_syscall_64+0x4e/0x1e0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 CPU: 1 UID: 0 PID: 1300113 Comm: xfs_scrub Not tainted 6.18.0-rc4-djwx #rc4 PREEMPT(lazy) 3d744dd94e92690f00a04398d2bd8631dcef1954 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-4.module+el8.8.0+21164+ed375313 04/01/2014 ================================================================== On further analysis, I realized that the second parameter to min() is not correct. xfs_ifork::if_bytes is the size of the xfs_ifork::if_data buffer. if_bytes can be smaller than the data fork size because: (a) the forkoff code tries to keep the data area as large as possible (b) for symbolic links, if_bytes is the ondisk file size + 1 (c) forkoff is always a multiple of 8. Case in point: for a single-byte symlink target, forkoff will be 8 but the buffer will only be 2 bytes long. In other words, the logic here is wrong and we walk off the end of the incore buffer. Fix that.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/678e1cc2f482e0985a0613ab4a5bf89c497e5acc
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/7c2d68e091584149fe89bcbaf9b99b3162d46ee7
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/81a8685cac4bf081c93a7df591644f4f80240bb9

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/scrub/symlink_repair.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7c2d68e091584149fe89bcbaf9b99b3162d46ee7",
              "status": "affected",
              "version": "2651923d8d8db00a57665822f017fa7c76758044",
              "versionType": "git"
            },
            {
              "lessThan": "81a8685cac4bf081c93a7df591644f4f80240bb9",
              "status": "affected",
              "version": "2651923d8d8db00a57665822f017fa7c76758044",
              "versionType": "git"
            },
            {
              "lessThan": "678e1cc2f482e0985a0613ab4a5bf89c497e5acc",
              "status": "affected",
              "version": "2651923d8d8db00a57665822f017fa7c76758044",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/scrub/symlink_repair.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix out of bounds memory read error in symlink repair\n\nxfs/286 produced this report on my test fleet:\n\n ==================================================================\n BUG: KFENCE: out-of-bounds read in memcpy_orig+0x54/0x110\n\n Out-of-bounds read at 0xffff88843fe9e038 (184B right of kfence-#184):\n  memcpy_orig+0x54/0x110\n  xrep_symlink_salvage_inline+0xb3/0xf0 [xfs]\n  xrep_symlink_salvage+0x100/0x110 [xfs]\n  xrep_symlink+0x2e/0x80 [xfs]\n  xrep_attempt+0x61/0x1f0 [xfs]\n  xfs_scrub_metadata+0x34f/0x5c0 [xfs]\n  xfs_ioc_scrubv_metadata+0x387/0x560 [xfs]\n  xfs_file_ioctl+0xe23/0x10e0 [xfs]\n  __x64_sys_ioctl+0x76/0xc0\n  do_syscall_64+0x4e/0x1e0\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n kfence-#184: 0xffff88843fe9df80-0xffff88843fe9dfea, size=107, cache=kmalloc-128\n\n allocated by task 3470 on cpu 1 at 263329.131592s (192823.508886s ago):\n  xfs_init_local_fork+0x79/0xe0 [xfs]\n  xfs_iformat_local+0xa4/0x170 [xfs]\n  xfs_iformat_data_fork+0x148/0x180 [xfs]\n  xfs_inode_from_disk+0x2cd/0x480 [xfs]\n  xfs_iget+0x450/0xd60 [xfs]\n  xfs_bulkstat_one_int+0x6b/0x510 [xfs]\n  xfs_bulkstat_iwalk+0x1e/0x30 [xfs]\n  xfs_iwalk_ag_recs+0xdf/0x150 [xfs]\n  xfs_iwalk_run_callbacks+0xb9/0x190 [xfs]\n  xfs_iwalk_ag+0x1dc/0x2f0 [xfs]\n  xfs_iwalk_args.constprop.0+0x6a/0x120 [xfs]\n  xfs_iwalk+0xa4/0xd0 [xfs]\n  xfs_bulkstat+0xfa/0x170 [xfs]\n  xfs_ioc_fsbulkstat.isra.0+0x13a/0x230 [xfs]\n  xfs_file_ioctl+0xbf2/0x10e0 [xfs]\n  __x64_sys_ioctl+0x76/0xc0\n  do_syscall_64+0x4e/0x1e0\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n CPU: 1 UID: 0 PID: 1300113 Comm: xfs_scrub Not tainted 6.18.0-rc4-djwx #rc4 PREEMPT(lazy)  3d744dd94e92690f00a04398d2bd8631dcef1954\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-4.module+el8.8.0+21164+ed375313 04/01/2014\n ==================================================================\n\nOn further analysis, I realized that the second parameter to min() is\nnot correct.  xfs_ifork::if_bytes is the size of the xfs_ifork::if_data\nbuffer.  if_bytes can be smaller than the data fork size because:\n\n(a) the forkoff code tries to keep the data area as large as possible\n(b) for symbolic links, if_bytes is the ondisk file size + 1\n(c) forkoff is always a multiple of 8.\n\nCase in point: for a single-byte symlink target, forkoff will be\n8 but the buffer will only be 2 bytes long.\n\nIn other words, the logic here is wrong and we walk off the end of the\nincore buffer.  Fix that."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfs: soluci\u00f3n de error de lectura de memoria fuera de l\u00edmites en la reparaci\u00f3n de enlaces simb\u00f3licos\n\nxfs/286 produjo este informe en mi flota de pruebas:\n\n ==================================================================\n ERROR: KFENCE: lectura fuera de l\u00edmites en memcpy_orig+0x54/0x110\n\n Lectura fuera de l\u00edmites en 0xffff88843fe9e038 (184B a la derecha de kfence-#184):\n  memcpy_orig+0x54/0x110\n  xrep_symlink_salvage_inline+0xb3/0xf0 [xfs]\n  xrep_symlink_salvage+0x100/0x110 [xfs]\n  xrep_symlink+0x2e/0x80 [xfs]\n  xrep_attempt+0x61/0x1f0 [xfs]\n  xfs_scrub_metadata+0x34f/0x5c0 [xfs]\n  xfs_ioc_scrubv_metadata+0x387/0x560 [xfs]\n  xfs_file_ioctl+0xe23/0x10e0 [xfs]\n  __x64_sys_ioctl+0x76/0xc0\n  do_syscall_64+0x4e/0x1e0\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n kfence-#184: 0xffff88843fe9df80-0xffff88843fe9dfea, tama\u00f1o=107, cach\u00e9=kmalloc-128\n\n asignado por la tarea 3470 en la CPU 1 a las 263329.131592s (hace 192823.508886s):\n  xfs_init_local_fork+0x79/0xe0 [xfs]\n  xfs_iformat_local+0xa4/0x170 [xfs]\n  xfs_iformat_data_fork+0x148/0x180 [xfs]\n  xfs_inode_from_disk+0x2cd/0x480 [xfs]\n  xfs_iget+0x450/0xd60 [xfs]\n  xfs_bulkstat_one_int+0x6b/0x510 [xfs]\n  xfs_bulkstat_iwalk+0x1e/0x30 [xfs]\n  xfs_iwalk_ag_recs+0xdf/0x150 [xfs]\n  xfs_iwalk_run_callbacks+0xb9/0x190 [xfs]\n  xfs_iwalk_ag+0x1dc/0x2f0 [xfs]\n  xfs_iwalk_args.constprop.0+0x6a/0x120 [xfs]\n  xfs_iwalk+0xa4/0xd0 [xfs]\n  xfs_bulkstat+0xfa/0x170 [xfs]\n  xfs_ioc_fsbulkstat.isra.0+0x13a/0x230 [xfs]\n  xfs_file_ioctl+0xbf2/0x10e0 [xfs]\n  __x64_sys_ioctl+0x76/0xc0\n  do_syscall_64+0x4e/0x1e0\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n CPU: 1 UID: 0 PID: 1300113 Comm: xfs_scrub No contaminado 6.18.0-rc4-djwx #rc4 PREEMPT(lazy)  3d744dd94e92690f00a04398d2bd8631dcef1954\n Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-4.module+el8.8.0+21164+ed375313 04/01/2014\n ==================================================================\n\nTras un an\u00e1lisis adicional, me di cuenta de que el segundo par\u00e1metro de min() no es correcto. xfs_ifork::if_bytes es el tama\u00f1o del b\u00fafer xfs_ifork::if_data. if_bytes puede ser menor que el tama\u00f1o del data fork porque:\n\n(a) el c\u00f3digo forkoff intenta mantener el \u00e1rea de datos lo m\u00e1s grande posible\n(b) para enlaces simb\u00f3licos, if_bytes es el tama\u00f1o del archivo en disco + 1\n(c) forkoff es siempre un m\u00faltiplo de 8.\n\nUn ejemplo claro: para un objetivo de enlace simb\u00f3lico de un solo byte, forkoff ser\u00e1 8 pero el b\u00fafer solo tendr\u00e1 2 bytes de longitud.\n\nEn otras palabras, la l\u00f3gica aqu\u00ed es incorrecta y nos salimos del final del b\u00fafer en memoria. Corregir eso."
    }
  ],
  "id": "CVE-2025-40246",
  "lastModified": "2026-10-19T19:10:00.130",
  "metrics": {},
  "published": "2025-12-04T16:16:17.970",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/678e1cc2f482e0985a0613ab4a5bf89c497e5acc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7c2d68e091584149fe89bcbaf9b99b3162d46ee7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/81a8685cac4bf081c93a7df591644f4f80240bb9"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}

CVE-2025-40246 (GCVE-0-2025-40246)

Vulnerability from cvelistv5 – Published: 2025-12-04 16:08 – Updated: 2026-05-11 21:45

Title

xfs: fix out of bounds memory read error in symlink repair

Summary

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7033 records in the last 180 days details

References

3 references

URL	Tags
https://git.kernel.org/stable/c/7c2d68e091584149f…
https://git.kernel.org/stable/c/81a8685cac4bf081c…
https://git.kernel.org/stable/c/678e1cc2f482e0985…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2651923d8d8db00a57665822f017fa7c76758044 , < 7c2d68e091584149fe89bcbaf9b99b3162d46ee7 (git) Affected: 2651923d8d8db00a57665822f017fa7c76758044 , < 81a8685cac4bf081c93a7df591644f4f80240bb9 (git) Affected: 2651923d8d8db00a57665822f017fa7c76758044 , < 678e1cc2f482e0985a0613ab4a5bf89c497e5acc (git)
Linux	Linux	Affected: 6.10 Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.60 , ≤ 6.12.* (semver) Unaffected: 6.17.10 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/scrub/symlink_repair.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7c2d68e091584149fe89bcbaf9b99b3162d46ee7",
              "status": "affected",
              "version": "2651923d8d8db00a57665822f017fa7c76758044",
              "versionType": "git"
            },
            {
              "lessThan": "81a8685cac4bf081c93a7df591644f4f80240bb9",
              "status": "affected",
              "version": "2651923d8d8db00a57665822f017fa7c76758044",
              "versionType": "git"
            },
            {
              "lessThan": "678e1cc2f482e0985a0613ab4a5bf89c497e5acc",
              "status": "affected",
              "version": "2651923d8d8db00a57665822f017fa7c76758044",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/scrub/symlink_repair.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.60",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.10",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix out of bounds memory read error in symlink repair\n\nxfs/286 produced this report on my test fleet:\n\n ==================================================================\n BUG: KFENCE: out-of-bounds read in memcpy_orig+0x54/0x110\n\n Out-of-bounds read at 0xffff88843fe9e038 (184B right of kfence-#184):\n  memcpy_orig+0x54/0x110\n  xrep_symlink_salvage_inline+0xb3/0xf0 [xfs]\n  xrep_symlink_salvage+0x100/0x110 [xfs]\n  xrep_symlink+0x2e/0x80 [xfs]\n  xrep_attempt+0x61/0x1f0 [xfs]\n  xfs_scrub_metadata+0x34f/0x5c0 [xfs]\n  xfs_ioc_scrubv_metadata+0x387/0x560 [xfs]\n  xfs_file_ioctl+0xe23/0x10e0 [xfs]\n  __x64_sys_ioctl+0x76/0xc0\n  do_syscall_64+0x4e/0x1e0\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n kfence-#184: 0xffff88843fe9df80-0xffff88843fe9dfea, size=107, cache=kmalloc-128\n\n allocated by task 3470 on cpu 1 at 263329.131592s (192823.508886s ago):\n  xfs_init_local_fork+0x79/0xe0 [xfs]\n  xfs_iformat_local+0xa4/0x170 [xfs]\n  xfs_iformat_data_fork+0x148/0x180 [xfs]\n  xfs_inode_from_disk+0x2cd/0x480 [xfs]\n  xfs_iget+0x450/0xd60 [xfs]\n  xfs_bulkstat_one_int+0x6b/0x510 [xfs]\n  xfs_bulkstat_iwalk+0x1e/0x30 [xfs]\n  xfs_iwalk_ag_recs+0xdf/0x150 [xfs]\n  xfs_iwalk_run_callbacks+0xb9/0x190 [xfs]\n  xfs_iwalk_ag+0x1dc/0x2f0 [xfs]\n  xfs_iwalk_args.constprop.0+0x6a/0x120 [xfs]\n  xfs_iwalk+0xa4/0xd0 [xfs]\n  xfs_bulkstat+0xfa/0x170 [xfs]\n  xfs_ioc_fsbulkstat.isra.0+0x13a/0x230 [xfs]\n  xfs_file_ioctl+0xbf2/0x10e0 [xfs]\n  __x64_sys_ioctl+0x76/0xc0\n  do_syscall_64+0x4e/0x1e0\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n CPU: 1 UID: 0 PID: 1300113 Comm: xfs_scrub Not tainted 6.18.0-rc4-djwx #rc4 PREEMPT(lazy)  3d744dd94e92690f00a04398d2bd8631dcef1954\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-4.module+el8.8.0+21164+ed375313 04/01/2014\n ==================================================================\n\nOn further analysis, I realized that the second parameter to min() is\nnot correct.  xfs_ifork::if_bytes is the size of the xfs_ifork::if_data\nbuffer.  if_bytes can be smaller than the data fork size because:\n\n(a) the forkoff code tries to keep the data area as large as possible\n(b) for symbolic links, if_bytes is the ondisk file size + 1\n(c) forkoff is always a multiple of 8.\n\nCase in point: for a single-byte symlink target, forkoff will be\n8 but the buffer will only be 2 bytes long.\n\nIn other words, the logic here is wrong and we walk off the end of the\nincore buffer.  Fix that."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:45:37.260Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7c2d68e091584149fe89bcbaf9b99b3162d46ee7"
        },
        {
          "url": "https://git.kernel.org/stable/c/81a8685cac4bf081c93a7df591644f4f80240bb9"
        },
        {
          "url": "https://git.kernel.org/stable/c/678e1cc2f482e0985a0613ab4a5bf89c497e5acc"
        }
      ],
      "title": "xfs: fix out of bounds memory read error in symlink repair",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40246",
    "datePublished": "2025-12-04T16:08:09.751Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-05-11T21:45:37.260Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted