CVE-2026-68299 (GCVE-0-2026-68299)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:02 – Updated: 2026-08-19 16:32
VLAI
Title
vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
Summary
In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header instead, signalled by the VMXNET3_RCD_HDR_INNER_SHIFT bit in the completion descriptor. Since the function never skips the outer encapsulation, this mismatch triggers: - BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP), because the outer protocol is UDP (Geneve), not TCP. - BUG_ON(hdr.eth->h_proto != ...), when the tunnel's outer and inner IP versions differ (e.g. outer IPv6/inner IPv4 or vice versa). Check VMXNET3_RCD_HDR_INNER_SHIFT up front and bail out, since the function cannot locate the inner header it would need to parse. Also convert the remaining BUG_ON()s in this function to return 0 defensively.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc , < 2ddf51fcb6dd7d55ceef38e2e1a5ab2ab7fd47b0 (git)
Affected: 45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc , < fbab6b73cc086e32698c86e43d1b16bf17d24c36 (git)
Affected: 45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc , < 28e382646417c7e2be9c9a7079eddf627ff52b90 (git)
Affected: 45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc , < 667b6e52048eaf4dbcf1707ed87ffd44abb9cb38 (git)
Affected: 45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc , < 28cb5d8d13b4c1faf3f688f62e5df82fe7b438d8 (git)
Affected: 45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc , < 4fdb0f162ccdbe9626863b10003855703253fa29 (git)
Affected: 45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc , < b28596baf87e25a078789f1c05817c8a3bf71257 (git)
Affected: 45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc , < 34a71f5361fc3adb5b7138da78750b0d535a8252 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vmxnet3/vmxnet3_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2ddf51fcb6dd7d55ceef38e2e1a5ab2ab7fd47b0",
              "status": "affected",
              "version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
              "versionType": "git"
            },
            {
              "lessThan": "fbab6b73cc086e32698c86e43d1b16bf17d24c36",
              "status": "affected",
              "version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
              "versionType": "git"
            },
            {
              "lessThan": "28e382646417c7e2be9c9a7079eddf627ff52b90",
              "status": "affected",
              "version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
              "versionType": "git"
            },
            {
              "lessThan": "667b6e52048eaf4dbcf1707ed87ffd44abb9cb38",
              "status": "affected",
              "version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
              "versionType": "git"
            },
            {
              "lessThan": "28cb5d8d13b4c1faf3f688f62e5df82fe7b438d8",
              "status": "affected",
              "version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
              "versionType": "git"
            },
            {
              "lessThan": "4fdb0f162ccdbe9626863b10003855703253fa29",
              "status": "affected",
              "version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
              "versionType": "git"
            },
            {
              "lessThan": "b28596baf87e25a078789f1c05817c8a3bf71257",
              "status": "affected",
              "version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
              "versionType": "git"
            },
            {
              "lessThan": "34a71f5361fc3adb5b7138da78750b0d535a8252",
              "status": "affected",
              "version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vmxnet3/vmxnet3_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets\n\nvmxnet3_get_hdr_len() assumes gdesc-\u003ercd.v4/v6/tcp always describe the\nouter header, but for a Geneve-encapsulated packet the device can set\nthem based on the inner header instead, signalled by the\nVMXNET3_RCD_HDR_INNER_SHIFT bit in the completion descriptor. Since the\nfunction never skips the outer encapsulation, this mismatch triggers:\n\n- BUG_ON(hdr.ipv4-\u003eprotocol != IPPROTO_TCP), because the outer\n  protocol is UDP (Geneve), not TCP.\n- BUG_ON(hdr.eth-\u003eh_proto != ...), when the tunnel\u0027s outer and inner\n  IP versions differ (e.g. outer IPv6/inner IPv4 or vice versa).\n\nCheck VMXNET3_RCD_HDR_INNER_SHIFT up front and bail out, since the\nfunction cannot locate the inner header it would need to parse. Also\nconvert the remaining BUG_ON()s in this function to return 0\ndefensively."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is triggered purely by a received Geneve-encapsulated packet processed in the vmxnet3 RX completion path (vmxnet3_rq_rx_complete -\u003e vmxnet3_get_hdr_len); any remote host that can deliver such a frame to a VMware guest\u0027s vmxnet3 interface reaches the code, with no local access required.\nAC:L - The attacker only needs to send Geneve-encapsulated TCP traffic larger than the MTU to the target; the device then sets rcd.v4/v6/tcp from the inner header and the outer UDP protocol (or an outer/inner IP version mismatch) deterministically hits the BUG_ON, with no race or memory-layout dependency.\nPR:N - Packet reception and header-length estimation occur in the driver\u0027s NAPI RX path before any socket, credential, or authentication check, so an entirely unauthenticated remote sender triggers it.\nUI:N - The panic happens during normal NAPI RX processing of an incoming packet; no action by any local user or administrator is needed.\nS:U - The BUG_ON crashes the kernel that owns the vmxnet3 interface, and impact stays entirely within that kernel\u0027s security authority with no crossing into the hypervisor or another domain.\nC:N - The header parsing is bounded by the explicit skb_headlen()/maplen checks, so no out-of-bounds read occurs and no kernel memory contents are disclosed to the attacker before the BUG_ON aborts.\nI:N - No out-of-bounds or attacker-controlled write occurs; the mismatch is caught by the BUG_ON assertion, which halts execution rather than corrupting kernel memory or control flow.\nA:H - Hitting BUG_ON() in softirq/NAPI context oopses and panics the kernel, taking down the entire guest; a remote attacker can repeat it with a single crafted Geneve packet stream for a persistent denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:32:48.545Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2ddf51fcb6dd7d55ceef38e2e1a5ab2ab7fd47b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbab6b73cc086e32698c86e43d1b16bf17d24c36"
        },
        {
          "url": "https://git.kernel.org/stable/c/28e382646417c7e2be9c9a7079eddf627ff52b90"
        },
        {
          "url": "https://git.kernel.org/stable/c/667b6e52048eaf4dbcf1707ed87ffd44abb9cb38"
        },
        {
          "url": "https://git.kernel.org/stable/c/28cb5d8d13b4c1faf3f688f62e5df82fe7b438d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fdb0f162ccdbe9626863b10003855703253fa29"
        },
        {
          "url": "https://git.kernel.org/stable/c/b28596baf87e25a078789f1c05817c8a3bf71257"
        },
        {
          "url": "https://git.kernel.org/stable/c/34a71f5361fc3adb5b7138da78750b0d535a8252"
        }
      ],
      "title": "vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68299",
    "datePublished": "2026-08-10T12:02:33.213Z",
    "dateReserved": "2026-07-30T09:28:09.380Z",
    "dateUpdated": "2026-08-19T16:32:48.545Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68299",
      "date": "2026-09-22",
      "epss": "0.00501",
      "percentile": "0.41935"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/vmxnet3/vmxnet3_drv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2ddf51fcb6dd7d55ceef38e2e1a5ab2ab7fd47b0",
                    "status": "affected",
                    "version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fbab6b73cc086e32698c86e43d1b16bf17d24c36",
                    "status": "affected",
                    "version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "28e382646417c7e2be9c9a7079eddf627ff52b90",
                    "status": "affected",
                    "version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "667b6e52048eaf4dbcf1707ed87ffd44abb9cb38",
                    "status": "affected",
                    "version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "28cb5d8d13b4c1faf3f688f62e5df82fe7b438d8",
                    "status": "affected",
                    "version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4fdb0f162ccdbe9626863b10003855703253fa29",
                    "status": "affected",
                    "version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b28596baf87e25a078789f1c05817c8a3bf71257",
                    "status": "affected",
                    "version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "34a71f5361fc3adb5b7138da78750b0d535a8252",
                    "status": "affected",
                    "version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/vmxnet3/vmxnet3_drv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.2"
                  },
                  {
                    "lessThan": "4.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets\n\nvmxnet3_get_hdr_len() assumes gdesc-\u003ercd.v4/v6/tcp always describe the\nouter header, but for a Geneve-encapsulated packet the device can set\nthem based on the inner header instead, signalled by the\nVMXNET3_RCD_HDR_INNER_SHIFT bit in the completion descriptor. Since the\nfunction never skips the outer encapsulation, this mismatch triggers:\n\n- BUG_ON(hdr.ipv4-\u003eprotocol != IPPROTO_TCP), because the outer\n  protocol is UDP (Geneve), not TCP.\n- BUG_ON(hdr.eth-\u003eh_proto != ...), when the tunnel\u0027s outer and inner\n  IP versions differ (e.g. outer IPv6/inner IPv4 or vice versa).\n\nCheck VMXNET3_RCD_HDR_INNER_SHIFT up front and bail out, since the\nfunction cannot locate the inner header it would need to parse. Also\nconvert the remaining BUG_ON()s in this function to return 0\ndefensively."
          }
        ],
        "id": "CVE-2026-68299",
        "lastModified": "2026-08-19T17:20:41.040",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:19.440",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/28cb5d8d13b4c1faf3f688f62e5df82fe7b438d8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/28e382646417c7e2be9c9a7079eddf627ff52b90"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2ddf51fcb6dd7d55ceef38e2e1a5ab2ab7fd47b0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/34a71f5361fc3adb5b7138da78750b0d535a8252"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4fdb0f162ccdbe9626863b10003855703253fa29"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/667b6e52048eaf4dbcf1707ed87ffd44abb9cb38"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b28596baf87e25a078789f1c05817c8a3bf71257"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fbab6b73cc086e32698c86e43d1b16bf17d24c36"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-02T17:57:19+00:00",
      "cve": "CVE-2026-68299",
      "id": "CVE-2026-68299",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "274",
      "product_status:under_investigation": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68299.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:32:31Z",
      "cve": "CVE-2026-68299",
      "id": "CVE-2026-68299",
      "initial_release_date": "2026-08-14T17:14:26Z",
      "product_status:first_fixed": "23",
      "product_status:known_affected": "731",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68299",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68299.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.