CVE-2026-72242 (GCVE-0-2026-72242)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:54 – Updated: 2026-08-23 12:47
VLAI
Title
selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
Summary
In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() selinux_sctp_bind_connect() dereferences sk->sk_socket to pass a struct socket * to selinux_socket_bind() and selinux_socket_connect_helper(). However, when the hook is invoked from the ASCONF softirq path (sctp_process_asconf), there is no file reference guaranteeing that sk->sk_socket is non-NULL. The setsockopt callers (bindx, connectx, set_primary, sendmsg connect) hold a file reference and are not affected. Both selinux_socket_bind() and selinux_socket_connect_helper() immediately resolve sock->sk, never using the struct socket * for anything else. Refactor the inner logic into helpers that take a struct sock * directly so that selinux_sctp_bind_connect() never needs to touch sk->sk_socket at all.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d452930fd3b9031e59abfeddb2fa383f1403d61a , < e4f3b8db1b0c5e9f6374b8996d9e1888d1042b55 (git)
Affected: d452930fd3b9031e59abfeddb2fa383f1403d61a , < 2fcaf133a8fd88b69f32ebaecad93fd302da828f (git)
Affected: d452930fd3b9031e59abfeddb2fa383f1403d61a , < a4bc2fb8536488b37680c0b66c59434a4b7f8c2f (git)
Affected: d452930fd3b9031e59abfeddb2fa383f1403d61a , < 5d4d93f9bfbc997ffbb03cd6107e8f6979dbb9b4 (git)
Affected: d452930fd3b9031e59abfeddb2fa383f1403d61a , < cc8bd47b35eca82393cbad08b1cc86f02e034439 (git)
Affected: d452930fd3b9031e59abfeddb2fa383f1403d61a , < d61a80b17254be7230bc5544f8e62ddf21ab38e2 (git)
Affected: d452930fd3b9031e59abfeddb2fa383f1403d61a , < 37d642b37ccdc31e1947c2ebc8dc38f03d4a0ceb (git)
Affected: d452930fd3b9031e59abfeddb2fa383f1403d61a , < 56acfeb10019e200ab6787d01f8d7cbe0f01526f (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 5.10.266 , ≤ 5.10.* (semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/selinux/hooks.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e4f3b8db1b0c5e9f6374b8996d9e1888d1042b55",
              "status": "affected",
              "version": "d452930fd3b9031e59abfeddb2fa383f1403d61a",
              "versionType": "git"
            },
            {
              "lessThan": "2fcaf133a8fd88b69f32ebaecad93fd302da828f",
              "status": "affected",
              "version": "d452930fd3b9031e59abfeddb2fa383f1403d61a",
              "versionType": "git"
            },
            {
              "lessThan": "a4bc2fb8536488b37680c0b66c59434a4b7f8c2f",
              "status": "affected",
              "version": "d452930fd3b9031e59abfeddb2fa383f1403d61a",
              "versionType": "git"
            },
            {
              "lessThan": "5d4d93f9bfbc997ffbb03cd6107e8f6979dbb9b4",
              "status": "affected",
              "version": "d452930fd3b9031e59abfeddb2fa383f1403d61a",
              "versionType": "git"
            },
            {
              "lessThan": "cc8bd47b35eca82393cbad08b1cc86f02e034439",
              "status": "affected",
              "version": "d452930fd3b9031e59abfeddb2fa383f1403d61a",
              "versionType": "git"
            },
            {
              "lessThan": "d61a80b17254be7230bc5544f8e62ddf21ab38e2",
              "status": "affected",
              "version": "d452930fd3b9031e59abfeddb2fa383f1403d61a",
              "versionType": "git"
            },
            {
              "lessThan": "37d642b37ccdc31e1947c2ebc8dc38f03d4a0ceb",
              "status": "affected",
              "version": "d452930fd3b9031e59abfeddb2fa383f1403d61a",
              "versionType": "git"
            },
            {
              "lessThan": "56acfeb10019e200ab6787d01f8d7cbe0f01526f",
              "status": "affected",
              "version": "d452930fd3b9031e59abfeddb2fa383f1403d61a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/selinux/hooks.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: avoid sk_socket dereference in selinux_sctp_bind_connect()\n\nselinux_sctp_bind_connect() dereferences sk-\u003esk_socket to pass a\nstruct socket * to selinux_socket_bind() and\nselinux_socket_connect_helper().  However, when the hook is invoked\nfrom the ASCONF softirq path (sctp_process_asconf), there is no file\nreference guaranteeing that sk-\u003esk_socket is non-NULL.  The setsockopt\ncallers (bindx, connectx, set_primary, sendmsg connect) hold a file\nreference and are not affected.\n\nBoth selinux_socket_bind() and selinux_socket_connect_helper()\nimmediately resolve sock-\u003esk, never using the struct socket * for\nanything else.  Refactor the inner logic into helpers that take a\nstruct sock * directly so that selinux_sctp_bind_connect() never needs\nto touch sk-\u003esk_socket at all."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code runs in the SCTP receive softirq path when a remote peer sends an authenticated ASCONF chunk (ADD_IP/SET_PRIMARY) on an existing association; packets enter via sctp_rcv() from the network stack, not local syscalls.\nAC:L - An attacker with an established SCTP association controls ASCONF timing and can flood ADD_IP/SET_PRIMARY during the documented post-close() teardown window when sk_socket is NULL but associations still process shutdown-state packets.\nPR:N - Exploitation requires only the ability to complete a normal SCTP association handshake with a SELinux-protected peer; no Linux capabilities, root, or local shell access are needed to send the triggering ASCONF packets over the network.\nUI:N - No victim user action is required beyond normal server operation; the crash is triggered by attacker-sent ASCONF traffic arriving while the kernel processes socket teardown after application close(), not by opening files or clicking links.\nS:U - Impact is a kernel NULL pointer dereference panic/oops within the same kernel security domain; it does not cross VM, container, or IOMMU boundaries and is a standard remote denial-of-service against the host kernel.\nC:N - The failure mode is a direct NULL pointer dereference of sk-\u003esk_socket before reading sock-\u003esk; there is no use-after-free, out-of-bounds access, or memory corruption that could yield information disclosure.\nI:N - The bug does not write or corrupt memory; selinux_socket_bind()/connect_helper() crash immediately on the NULL socket pointer without modifying kernel data structures or achieving code execution.\nA:H - Dereferencing a NULL sk_socket in softirq causes a kernel oops/panic, crashing the entire system; this is repeatable whenever ASCONF arrives during the post-close() window on SCTP associations in shutdown states."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:05.827Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e4f3b8db1b0c5e9f6374b8996d9e1888d1042b55"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fcaf133a8fd88b69f32ebaecad93fd302da828f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4bc2fb8536488b37680c0b66c59434a4b7f8c2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d4d93f9bfbc997ffbb03cd6107e8f6979dbb9b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc8bd47b35eca82393cbad08b1cc86f02e034439"
        },
        {
          "url": "https://git.kernel.org/stable/c/d61a80b17254be7230bc5544f8e62ddf21ab38e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/37d642b37ccdc31e1947c2ebc8dc38f03d4a0ceb"
        },
        {
          "url": "https://git.kernel.org/stable/c/56acfeb10019e200ab6787d01f8d7cbe0f01526f"
        }
      ],
      "title": "selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72242",
    "datePublished": "2026-08-15T05:54:30.378Z",
    "dateReserved": "2026-08-09T03:40:39.914Z",
    "dateUpdated": "2026-08-23T12:47:05.827Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72242",
      "date": "2026-09-21",
      "epss": "0.00677",
      "percentile": "0.50462"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "security/selinux/hooks.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e4f3b8db1b0c5e9f6374b8996d9e1888d1042b55",
                    "status": "affected",
                    "version": "d452930fd3b9031e59abfeddb2fa383f1403d61a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2fcaf133a8fd88b69f32ebaecad93fd302da828f",
                    "status": "affected",
                    "version": "d452930fd3b9031e59abfeddb2fa383f1403d61a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a4bc2fb8536488b37680c0b66c59434a4b7f8c2f",
                    "status": "affected",
                    "version": "d452930fd3b9031e59abfeddb2fa383f1403d61a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5d4d93f9bfbc997ffbb03cd6107e8f6979dbb9b4",
                    "status": "affected",
                    "version": "d452930fd3b9031e59abfeddb2fa383f1403d61a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cc8bd47b35eca82393cbad08b1cc86f02e034439",
                    "status": "affected",
                    "version": "d452930fd3b9031e59abfeddb2fa383f1403d61a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d61a80b17254be7230bc5544f8e62ddf21ab38e2",
                    "status": "affected",
                    "version": "d452930fd3b9031e59abfeddb2fa383f1403d61a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "37d642b37ccdc31e1947c2ebc8dc38f03d4a0ceb",
                    "status": "affected",
                    "version": "d452930fd3b9031e59abfeddb2fa383f1403d61a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "56acfeb10019e200ab6787d01f8d7cbe0f01526f",
                    "status": "affected",
                    "version": "d452930fd3b9031e59abfeddb2fa383f1403d61a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "security/selinux/hooks.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.17"
                  },
                  {
                    "lessThan": "4.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.266",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.217",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.184",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: avoid sk_socket dereference in selinux_sctp_bind_connect()\n\nselinux_sctp_bind_connect() dereferences sk-\u003esk_socket to pass a\nstruct socket * to selinux_socket_bind() and\nselinux_socket_connect_helper().  However, when the hook is invoked\nfrom the ASCONF softirq path (sctp_process_asconf), there is no file\nreference guaranteeing that sk-\u003esk_socket is non-NULL.  The setsockopt\ncallers (bindx, connectx, set_primary, sendmsg connect) hold a file\nreference and are not affected.\n\nBoth selinux_socket_bind() and selinux_socket_connect_helper()\nimmediately resolve sock-\u003esk, never using the struct socket * for\nanything else.  Refactor the inner logic into helpers that take a\nstruct sock * directly so that selinux_sctp_bind_connect() never needs\nto touch sk-\u003esk_socket at all."
          }
        ],
        "id": "CVE-2026-72242",
        "lastModified": "2026-08-23T13:16:42.200",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:51.317",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2fcaf133a8fd88b69f32ebaecad93fd302da828f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/37d642b37ccdc31e1947c2ebc8dc38f03d4a0ceb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/56acfeb10019e200ab6787d01f8d7cbe0f01526f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5d4d93f9bfbc997ffbb03cd6107e8f6979dbb9b4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a4bc2fb8536488b37680c0b66c59434a4b7f8c2f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cc8bd47b35eca82393cbad08b1cc86f02e034439"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d61a80b17254be7230bc5544f8e62ddf21ab38e2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e4f3b8db1b0c5e9f6374b8996d9e1888d1042b55"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T10:51:06+00:00",
      "cve": "CVE-2026-72242",
      "id": "CVE-2026-72242",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72242.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T16:26:38Z",
      "cve": "CVE-2026-72242",
      "id": "CVE-2026-72242",
      "initial_release_date": "2026-08-31T16:26:38Z",
      "product_status:known_affected": "228",
      "product_status:known_not_affected": "134",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72242",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72242.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.