CVE-2026-72036 (GCVE-0-2026-72036)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-08-17 05:39
VLAI
Title
net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked multiq_dequeue() takes a packet from a band's child with a direct ->dequeue() call after multiq_peek() peeked it. When the child is non-work-conserving the peek stashes the skb in the child's gso_skb, so the direct dequeue returns a different skb and orphans the stash, desyncing the child's qlen/backlog. With a qfq child reached through a peeking parent (e.g. tbf) this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress. Take the packet through qdisc_dequeue_peeked(), as sch_prio already does and as sch_red and sch_sfb were just fixed to do. The helper is a no-op when the child has no stash, so a work-conserving child is unaffected.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 , < 3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a (git)
Affected: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 , < eb1a9637f0bd84b5db8803af65dfb1f44785406f (git)
Affected: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 , < 7a5a1582710981ef6637de9f074a60a5b1d63222 (git)
Affected: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 , < 86a61e46a1919e8abf4d227c204773dabb24068a (git)
Affected: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 , < 1b9cc255e8089606b92b2adf504e334573682821 (git)
Affected: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 , < 5889064919a1e5c0a9469c54895000414fc46944 (git)
Affected: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 , < fffeb2ab5eeb823d4c2330571a098f63237c9049 (git)
Affected: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 , < 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.29
Unaffected: 0 , < 2.6.29 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_multiq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a",
              "status": "affected",
              "version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
              "versionType": "git"
            },
            {
              "lessThan": "eb1a9637f0bd84b5db8803af65dfb1f44785406f",
              "status": "affected",
              "version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
              "versionType": "git"
            },
            {
              "lessThan": "7a5a1582710981ef6637de9f074a60a5b1d63222",
              "status": "affected",
              "version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
              "versionType": "git"
            },
            {
              "lessThan": "86a61e46a1919e8abf4d227c204773dabb24068a",
              "status": "affected",
              "version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
              "versionType": "git"
            },
            {
              "lessThan": "1b9cc255e8089606b92b2adf504e334573682821",
              "status": "affected",
              "version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
              "versionType": "git"
            },
            {
              "lessThan": "5889064919a1e5c0a9469c54895000414fc46944",
              "status": "affected",
              "version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
              "versionType": "git"
            },
            {
              "lessThan": "fffeb2ab5eeb823d4c2330571a098f63237c9049",
              "status": "affected",
              "version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
              "versionType": "git"
            },
            {
              "lessThan": "54f6b0c843e228d499eb4b6bbb89df68cad9ad5d",
              "status": "affected",
              "version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_multiq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked\n\nmultiq_dequeue() takes a packet from a band\u0027s child with a direct\n-\u003edequeue() call after multiq_peek() peeked it. When the child is\nnon-work-conserving the peek stashes the skb in the child\u0027s gso_skb, so\nthe direct dequeue returns a different skb and orphans the stash,\ndesyncing the child\u0027s qlen/backlog. With a qfq child reached through a\npeeking parent (e.g. tbf) this re-enters the child on an emptied list and\ndereferences NULL, panicking the kernel from softirq on ordinary egress.\n\nTake the packet through qdisc_dequeue_peeked(), as sch_prio already does\nand as sch_red and sch_sfb were just fixed to do. The helper is a no-op\nwhen the child has no stash, so a work-conserving child is unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires locally installing a tbf\u2192multiq\u2192qfq hierarchy on a multiqueue netdev via RTM_NEWQDISC/tc netlink before egress can hit multiq_dequeue(); per kernel CNA guidance, tc/qdisc configuration bugs are Local even though the panic fires from softirq during packet transmission.\nAC:L - Once the hierarchy exists, the peek/dequeue mismatch is a deterministic logic bug: tbf peek stashes the QFQ child\u0027s skb in gso_skb, then multiq_dequeue\u0027s direct child-\u003edequeue() bypasses that stash and re-enters QFQ on an emptied list; ping reproducers for sch_red/sfb show no race or layout dependency.\nPR:L - RTM_NEWQDISC and qdisc grafting are gated by netlink_net_capable(skb, CAP_NET_ADMIN) in rtnetlink_rcv_msg, evaluated against net-\u003euser_ns; unprivileged users obtain CAP_NET_ADMIN via user/network namespaces (unshare -Urn) without init-namespace root.\nUI:N - No victim interaction is needed after qdisc setup; triggering the NULL dereference requires only attacker-generated egress traffic (e.g., ping) through the defective tbf\u2192multiq\u2192qfq dequeue path.\nS:U - The qlen/backlog desync, orphaned gso_skb stash, and resulting kernel panic occur entirely within the host kernel packet scheduler; no VM, IOMMU, or sandbox security boundary is crossed.\nC:H - Peek stashes the skb in the non-work-conserving child\u0027s gso_skb while direct dequeue returns a different packet, desyncing qlen/backlog\u2014the same scheduler-accounting corruption primitive seen in prior net/sched CVEs and capable of exposing corrupted or freed kernel scheduler memory.\nI:H - Orphaning the gso_skb stash corrupts parent/child queue linkage and QFQ aggregate scheduling state; inconsistent qlen drives invalid list operations in qfq_dequeue, yielding attacker-influenced memory corruption beyond the demonstrated NULL dereference.\nA:H - The desync re-enters QFQ on an emptied aggregate list and dereferences NULL in qfq_dequeue from softirq during ordinary egress, panicking the kernel as documented in the fix commit and matching KASAN null-ptr-deref traces in the related sch_red/sch_sfb reports."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:39.361Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb1a9637f0bd84b5db8803af65dfb1f44785406f"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a5a1582710981ef6637de9f074a60a5b1d63222"
        },
        {
          "url": "https://git.kernel.org/stable/c/86a61e46a1919e8abf4d227c204773dabb24068a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b9cc255e8089606b92b2adf504e334573682821"
        },
        {
          "url": "https://git.kernel.org/stable/c/5889064919a1e5c0a9469c54895000414fc46944"
        },
        {
          "url": "https://git.kernel.org/stable/c/fffeb2ab5eeb823d4c2330571a098f63237c9049"
        },
        {
          "url": "https://git.kernel.org/stable/c/54f6b0c843e228d499eb4b6bbb89df68cad9ad5d"
        }
      ],
      "title": "net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72036",
    "datePublished": "2026-08-15T05:51:57.012Z",
    "dateReserved": "2026-08-09T03:40:39.901Z",
    "dateUpdated": "2026-08-17T05:39:39.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72036",
      "date": "2026-09-21",
      "epss": "0.00169",
      "percentile": "0.06589"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sched/sch_multiq.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a",
                    "status": "affected",
                    "version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eb1a9637f0bd84b5db8803af65dfb1f44785406f",
                    "status": "affected",
                    "version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7a5a1582710981ef6637de9f074a60a5b1d63222",
                    "status": "affected",
                    "version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "86a61e46a1919e8abf4d227c204773dabb24068a",
                    "status": "affected",
                    "version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1b9cc255e8089606b92b2adf504e334573682821",
                    "status": "affected",
                    "version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5889064919a1e5c0a9469c54895000414fc46944",
                    "status": "affected",
                    "version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fffeb2ab5eeb823d4c2330571a098f63237c9049",
                    "status": "affected",
                    "version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "54f6b0c843e228d499eb4b6bbb89df68cad9ad5d",
                    "status": "affected",
                    "version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sched/sch_multiq.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.29"
                  },
                  {
                    "lessThan": "2.6.29",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked\n\nmultiq_dequeue() takes a packet from a band\u0027s child with a direct\n-\u003edequeue() call after multiq_peek() peeked it. When the child is\nnon-work-conserving the peek stashes the skb in the child\u0027s gso_skb, so\nthe direct dequeue returns a different skb and orphans the stash,\ndesyncing the child\u0027s qlen/backlog. With a qfq child reached through a\npeeking parent (e.g. tbf) this re-enters the child on an emptied list and\ndereferences NULL, panicking the kernel from softirq on ordinary egress.\n\nTake the packet through qdisc_dequeue_peeked(), as sch_prio already does\nand as sch_red and sch_sfb were just fixed to do. The helper is a no-op\nwhen the child has no stash, so a work-conserving child is unaffected."
          }
        ],
        "id": "CVE-2026-72036",
        "lastModified": "2026-08-17T06:18:01.457",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:12.613",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1b9cc255e8089606b92b2adf504e334573682821"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/54f6b0c843e228d499eb4b6bbb89df68cad9ad5d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5889064919a1e5c0a9469c54895000414fc46944"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7a5a1582710981ef6637de9f074a60a5b1d63222"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/86a61e46a1919e8abf4d227c204773dabb24068a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eb1a9637f0bd84b5db8803af65dfb1f44785406f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fffeb2ab5eeb823d4c2330571a098f63237c9049"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T11:34:31+00:00",
      "cve": "CVE-2026-72036",
      "id": "CVE-2026-72036",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72036.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:28:58Z",
      "cve": "CVE-2026-72036",
      "id": "CVE-2026-72036",
      "initial_release_date": "2026-08-27T16:53:52Z",
      "product_status:first_fixed": "23",
      "product_status:known_affected": "715",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72036",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72036.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.