CVE-2026-72489 (GCVE-0-2026-72489)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:44
VLAI
Title
staging: nvec: fix use-after-free in nvec_rx_completed()
Summary
In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvec_rx_completed() In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type. Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d6bdcf2e1019351cbc176e963b7756766bdd8721 , < 6b2ea886ebdae44a2394029844a4e78f58e1587d (git)
Affected: d6bdcf2e1019351cbc176e963b7756766bdd8721 , < a37625c7b688fcf68a54263528eccbabfd7fa17a (git)
Affected: d6bdcf2e1019351cbc176e963b7756766bdd8721 , < 9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89 (git)
Affected: d6bdcf2e1019351cbc176e963b7756766bdd8721 , < 08626fcfe12308ca3f8b22c538ba7dee0b2dce7a (git)
Affected: d6bdcf2e1019351cbc176e963b7756766bdd8721 , < f19a5bc059051143c489dd6f79a0f9c3bfd13aea (git)
Affected: d6bdcf2e1019351cbc176e963b7756766bdd8721 , < bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90 (git)
Affected: d6bdcf2e1019351cbc176e963b7756766bdd8721 , < 5de04caa46b635e180cecbd164e333eca535db94 (git)
Affected: d6bdcf2e1019351cbc176e963b7756766bdd8721 , < 26813881181deb3a32fbb59eadb2599cbe8423f6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.2
Unaffected: 0 , < 3.2 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/nvec/nvec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b2ea886ebdae44a2394029844a4e78f58e1587d",
              "status": "affected",
              "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
              "versionType": "git"
            },
            {
              "lessThan": "a37625c7b688fcf68a54263528eccbabfd7fa17a",
              "status": "affected",
              "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
              "versionType": "git"
            },
            {
              "lessThan": "9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89",
              "status": "affected",
              "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
              "versionType": "git"
            },
            {
              "lessThan": "08626fcfe12308ca3f8b22c538ba7dee0b2dce7a",
              "status": "affected",
              "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
              "versionType": "git"
            },
            {
              "lessThan": "f19a5bc059051143c489dd6f79a0f9c3bfd13aea",
              "status": "affected",
              "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
              "versionType": "git"
            },
            {
              "lessThan": "bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90",
              "status": "affected",
              "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
              "versionType": "git"
            },
            {
              "lessThan": "5de04caa46b635e180cecbd164e333eca535db94",
              "status": "affected",
              "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
              "versionType": "git"
            },
            {
              "lessThan": "26813881181deb3a32fbb59eadb2599cbe8423f6",
              "status": "affected",
              "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/nvec/nvec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: nvec: fix use-after-free in nvec_rx_completed()\n\nIn nvec_rx_completed(), when an incomplete RX transfer is detected,\nnvec_msg_free() is called to return the message back to the pool by\nclearing its \u0027used\u0027 atomic flag. Immediately after this, the code\naccesses nvec-\u003erx-\u003edata[0] to check the message type.\n\nSince nvec_msg_free() marks the pool slot as available via atomic_set(),\nany concurrent or subsequent call to nvec_msg_alloc() could claim that\nsame slot and overwrite its data[] array. Reading nvec-\u003erx-\u003edata[0] after\nfreeing the message is therefore a use-after-free.\n\nFix this by saving the message type byte before calling nvec_msg_free(),\nthen using the saved value for the battery quirk check."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is hit in the I2C slave IRQ handler when the embedded controller ends an RX transfer early; on affected Tegra20 PAZ00 netbooks a local actor can reach it by stressing EC traffic via kernel battery polling and userspace sysfs/input subdrivers (LED, keyboard) that call nvec_write_async().\nAC:L - This is a use-after-free where nvec_msg_free() returns the RX pool slot and the handler immediately re-reads nvec-\u003erx-\u003edata[0]; on SMP an attacker can provoke incomplete NVEC_BAT responses while concurrent I2C IRQs call nvec_msg_alloc(), controlling both sides of the slot-reuse race.\nPR:N - No elevated privileges are needed because the nvec-power delayed worker automatically issues NVEC_BAT requests every five seconds at boot, and documented incomplete EC battery responses can reach the vulnerable IRQ path before any user authentication or special capabilities.\nUI:N - Exploitation does not require victim interaction; kernel background battery and AC polling plus EC-initiated incomplete transfers can invoke nvec_rx_completed() without the user mounting filesystems, opening files, or performing other deliberate actions.\nS:U - Impact is confined to kernel memory and privileges on the same Tegra SoC running the driver; this is not a VM escape, hypervisor breakout, or other cross-security-authority boundary violation.\nC:H - Reading nvec-\u003erx-\u003edata[0] after nvec_msg_free() is a use-after-free on a msg_pool slot where concurrent nvec_msg_alloc() can overwrite data[], yielding attacker-influenced kernel memory reads and potential disclosure of pointers or adjacent structure contents.\nI:H - Use-after-free on reusable nvec_msg pool entries can be leveraged for controlled reuse of freed message buffers, enabling heap-style corruption primitives that may lead to arbitrary kernel memory writes and privilege escalation or code execution.\nA:H - The post-free read can mis-handle ec_transfer completion and corrupt IRQ-time state; use-after-free in hardirq context can kernel oops or panic the system, consistent with the original battery-quirk crash this code path was introduced to mitigate."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:44:51.131Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b2ea886ebdae44a2394029844a4e78f58e1587d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a37625c7b688fcf68a54263528eccbabfd7fa17a"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89"
        },
        {
          "url": "https://git.kernel.org/stable/c/08626fcfe12308ca3f8b22c538ba7dee0b2dce7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f19a5bc059051143c489dd6f79a0f9c3bfd13aea"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90"
        },
        {
          "url": "https://git.kernel.org/stable/c/5de04caa46b635e180cecbd164e333eca535db94"
        },
        {
          "url": "https://git.kernel.org/stable/c/26813881181deb3a32fbb59eadb2599cbe8423f6"
        }
      ],
      "title": "staging: nvec: fix use-after-free in nvec_rx_completed()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72489",
    "datePublished": "2026-08-15T05:57:24.948Z",
    "dateReserved": "2026-08-09T03:40:39.936Z",
    "dateUpdated": "2026-08-17T05:44:51.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72489",
      "date": "2026-09-21",
      "epss": "0.00148",
      "percentile": "0.04372"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/staging/nvec/nvec.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6b2ea886ebdae44a2394029844a4e78f58e1587d",
                    "status": "affected",
                    "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a37625c7b688fcf68a54263528eccbabfd7fa17a",
                    "status": "affected",
                    "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89",
                    "status": "affected",
                    "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "08626fcfe12308ca3f8b22c538ba7dee0b2dce7a",
                    "status": "affected",
                    "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f19a5bc059051143c489dd6f79a0f9c3bfd13aea",
                    "status": "affected",
                    "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90",
                    "status": "affected",
                    "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5de04caa46b635e180cecbd164e333eca535db94",
                    "status": "affected",
                    "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "26813881181deb3a32fbb59eadb2599cbe8423f6",
                    "status": "affected",
                    "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/staging/nvec/nvec.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.2"
                  },
                  {
                    "lessThan": "3.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: nvec: fix use-after-free in nvec_rx_completed()\n\nIn nvec_rx_completed(), when an incomplete RX transfer is detected,\nnvec_msg_free() is called to return the message back to the pool by\nclearing its \u0027used\u0027 atomic flag. Immediately after this, the code\naccesses nvec-\u003erx-\u003edata[0] to check the message type.\n\nSince nvec_msg_free() marks the pool slot as available via atomic_set(),\nany concurrent or subsequent call to nvec_msg_alloc() could claim that\nsame slot and overwrite its data[] array. Reading nvec-\u003erx-\u003edata[0] after\nfreeing the message is therefore a use-after-free.\n\nFix this by saving the message type byte before calling nvec_msg_free(),\nthen using the saved value for the battery quirk check."
          }
        ],
        "id": "CVE-2026-72489",
        "lastModified": "2026-08-17T06:19:17.150",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:23.190",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/08626fcfe12308ca3f8b22c538ba7dee0b2dce7a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/26813881181deb3a32fbb59eadb2599cbe8423f6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5de04caa46b635e180cecbd164e333eca535db94"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6b2ea886ebdae44a2394029844a4e78f58e1587d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a37625c7b688fcf68a54263528eccbabfd7fa17a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f19a5bc059051143c489dd6f79a0f9c3bfd13aea"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-01T10:36:51+00:00",
      "cve": "CVE-2026-72489",
      "id": "CVE-2026-72489",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: staging: nvec: fix use-after-free in nvec_rx_completed()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72489.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-10T02:05:23Z",
      "cve": "CVE-2026-72489",
      "id": "CVE-2026-72489",
      "initial_release_date": "2026-08-27T00:23:18Z",
      "product_status:known_affected": "265",
      "product_status:known_not_affected": "97",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72489",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72489.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.