CVE-2026-74305 (GCVE-0-2026-74305)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:45
VLAI
Title
bpf: Tighten cgroup storage cookie checks for prog arrays
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 ("bpf: Fix oob access in cgroup local storage") is still incomplete. The prog-array compatibility check treats a program with no cgroup storage as compatible with any stored storage cookie. This allows a storage-less program to bridge a tail call chain between an entry program and a storage-using callee even though cgroup local storage at runtime still follows the caller's context, that is, A -> B(no storage) -> C(storage) path. Requiring exact cookie equality would break the legitimate case of a storage-less leaf program being tail called from a storage-using one. Instead, only accept a zero storage cookie if the program cannot perform tail calls itself. This keeps A -> B(no storage) working while rejecting the A -> B(no storage) -> C(storage) bridge.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c1c74584b9b4043c52e41fec415226e582d266a3 , < 87177497cca90bf4fcfb759eb898560eb5b46a10 (git)
Affected: 66da7cee78590259b400e51a70622ccd41da7bb2 , < 1c762d28698483ce7c372091f34d86e4d4828652 (git)
Affected: 7acfa07c585e3d7a64654d38f0a5c762877d0b9b , < eb73056ce2a6f101ddd3bdba89af6b24ebffff85 (git)
Affected: 41688d1fc5d163a6c2c0e95c0419e2cb31a44648 , < 9ca06849c4239aa2d580c54651f8588c51cb398b (git)
Affected: abad3d0bad72a52137e0c350c59542d75ae4f513 , < 46fbafe3d2d569d828e8d24a7dbe1659f63685cf (git)
Affected: abad3d0bad72a52137e0c350c59542d75ae4f513 , < cb22dc79528eb26a46d346c3118dbd6b14c70609 (git)
Affected: abad3d0bad72a52137e0c350c59542d75ae4f513 , < 10627ddc0167aab5c1c390a10ef461e9937aba08 (git)
Affected: 19341d5c59e8c7e8528e40f8663e99d67810473c (git)
Affected: 5.15.192 , < 5.15.212 (semver)
Affected: 6.1.151 , < 6.1.178 (semver)
Affected: 6.6.105 , < 6.6.145 (semver)
Affected: 6.12.46 , < 6.12.97 (semver)
Affected: 6.16.1 , < 6.17 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "87177497cca90bf4fcfb759eb898560eb5b46a10",
              "status": "affected",
              "version": "c1c74584b9b4043c52e41fec415226e582d266a3",
              "versionType": "git"
            },
            {
              "lessThan": "1c762d28698483ce7c372091f34d86e4d4828652",
              "status": "affected",
              "version": "66da7cee78590259b400e51a70622ccd41da7bb2",
              "versionType": "git"
            },
            {
              "lessThan": "eb73056ce2a6f101ddd3bdba89af6b24ebffff85",
              "status": "affected",
              "version": "7acfa07c585e3d7a64654d38f0a5c762877d0b9b",
              "versionType": "git"
            },
            {
              "lessThan": "9ca06849c4239aa2d580c54651f8588c51cb398b",
              "status": "affected",
              "version": "41688d1fc5d163a6c2c0e95c0419e2cb31a44648",
              "versionType": "git"
            },
            {
              "lessThan": "46fbafe3d2d569d828e8d24a7dbe1659f63685cf",
              "status": "affected",
              "version": "abad3d0bad72a52137e0c350c59542d75ae4f513",
              "versionType": "git"
            },
            {
              "lessThan": "cb22dc79528eb26a46d346c3118dbd6b14c70609",
              "status": "affected",
              "version": "abad3d0bad72a52137e0c350c59542d75ae4f513",
              "versionType": "git"
            },
            {
              "lessThan": "10627ddc0167aab5c1c390a10ef461e9937aba08",
              "status": "affected",
              "version": "abad3d0bad72a52137e0c350c59542d75ae4f513",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "19341d5c59e8c7e8528e40f8663e99d67810473c",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.212",
              "status": "affected",
              "version": "5.15.192",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.178",
              "status": "affected",
              "version": "6.1.151",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.105",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.97",
              "status": "affected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThan": "6.17",
              "status": "affected",
              "version": "6.16.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15.192",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1.151",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.105",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.12.46",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.16.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Tighten cgroup storage cookie checks for prog arrays\n\nThe fix in commit abad3d0bad72 (\"bpf: Fix oob access in cgroup local\nstorage\") is still incomplete. The prog-array compatibility check\ntreats a program with no cgroup storage as compatible with any stored\nstorage cookie. This allows a storage-less program to bridge a tail\ncall chain between an entry program and a storage-using callee even\nthough cgroup local storage at runtime still follows the caller\u0027s\ncontext, that is, A -\u003e B(no storage) -\u003e C(storage) path.\n\nRequiring exact cookie equality would break the legitimate case of a\nstorage-less leaf program being tail called from a storage-using one.\nInstead, only accept a zero storage cookie if the program cannot\nperform tail calls itself. This keeps A -\u003e B(no storage) working\nwhile rejecting the A -\u003e B(no storage) -\u003e C(storage) bridge."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local bpf() syscalls to load cgroup BPF programs/maps, populate a prog array, attach or test-run them; per kernel guidance BPF/cgroup hooks are Local even when later triggered by sockets or packets.\nAC:L - The attacker fully controls crafting programs A/B/C, prog-array insertion order, and triggering the cgroup hook or BPF_PROG_TEST_RUN; no race or victim-dependent state is required to reach the mismatched-storage OOB path.\nPR:L - Reaching the buggy compatibility check needs only local BPF privileges (CAP_BPF or unprivileged BPF where enabled) plus cgroup attach/test-run access obtainable by unprivileged users in delegated cgroups or user namespaces, not init-namespace root.\nUI:N - The attacker loads, wires, and triggers the malicious BPF program chain itself (e.g., creating a socket or using BPF_PROG_TEST_RUN); no action by another user or administrator is required.\nS:U - The out-of-bounds cgroup local storage access corrupts kernel heap memory within the same kernel security domain and enables local privilege escalation, not a cross-boundary VM, IOMMU, or sandbox escape.\nC:H - Tail-called program C obtains a pointer from bpf_get_local_storage() backed by entry program A\u0027s smaller cgroup storage while verifier-approved helpers perform larger accesses, yielding controllable out-of-bounds kernel heap reads.\nI:H - The returned cgroup storage pointer is writable map memory, and size-mismatched helper copies (e.g., bpf_map_update_elem/copy_map_value_long) enable controllable out-of-bounds heap writes exploitable for kernel corruption and code execution.\nA:H - The heap out-of-bounds read/write can corrupt adjacent kernel objects and readily trigger kernel oops/panic or denial of service, as demonstrated by the cgroup_storage_oob selftest expecting KASAN reports without the fix."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:39.394Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/87177497cca90bf4fcfb759eb898560eb5b46a10"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c762d28698483ce7c372091f34d86e4d4828652"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb73056ce2a6f101ddd3bdba89af6b24ebffff85"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ca06849c4239aa2d580c54651f8588c51cb398b"
        },
        {
          "url": "https://git.kernel.org/stable/c/46fbafe3d2d569d828e8d24a7dbe1659f63685cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb22dc79528eb26a46d346c3118dbd6b14c70609"
        },
        {
          "url": "https://git.kernel.org/stable/c/10627ddc0167aab5c1c390a10ef461e9937aba08"
        }
      ],
      "title": "bpf: Tighten cgroup storage cookie checks for prog arrays",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74305",
    "datePublished": "2026-08-15T05:58:06.654Z",
    "dateReserved": "2026-08-15T05:44:03.882Z",
    "dateUpdated": "2026-08-17T05:45:39.394Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74305",
      "date": "2026-09-20",
      "epss": "0.00129",
      "percentile": "0.02944"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "87177497cca90bf4fcfb759eb898560eb5b46a10",
                    "status": "affected",
                    "version": "c1c74584b9b4043c52e41fec415226e582d266a3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1c762d28698483ce7c372091f34d86e4d4828652",
                    "status": "affected",
                    "version": "66da7cee78590259b400e51a70622ccd41da7bb2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eb73056ce2a6f101ddd3bdba89af6b24ebffff85",
                    "status": "affected",
                    "version": "7acfa07c585e3d7a64654d38f0a5c762877d0b9b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9ca06849c4239aa2d580c54651f8588c51cb398b",
                    "status": "affected",
                    "version": "41688d1fc5d163a6c2c0e95c0419e2cb31a44648",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "46fbafe3d2d569d828e8d24a7dbe1659f63685cf",
                    "status": "affected",
                    "version": "abad3d0bad72a52137e0c350c59542d75ae4f513",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cb22dc79528eb26a46d346c3118dbd6b14c70609",
                    "status": "affected",
                    "version": "abad3d0bad72a52137e0c350c59542d75ae4f513",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "10627ddc0167aab5c1c390a10ef461e9937aba08",
                    "status": "affected",
                    "version": "abad3d0bad72a52137e0c350c59542d75ae4f513",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "19341d5c59e8c7e8528e40f8663e99d67810473c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.15.212",
                    "status": "affected",
                    "version": "5.15.192",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.178",
                    "status": "affected",
                    "version": "6.1.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.145",
                    "status": "affected",
                    "version": "6.6.105",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.97",
                    "status": "affected",
                    "version": "6.12.46",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "affected",
                    "version": "6.16.1",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.17"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Tighten cgroup storage cookie checks for prog arrays\n\nThe fix in commit abad3d0bad72 (\"bpf: Fix oob access in cgroup local\nstorage\") is still incomplete. The prog-array compatibility check\ntreats a program with no cgroup storage as compatible with any stored\nstorage cookie. This allows a storage-less program to bridge a tail\ncall chain between an entry program and a storage-using callee even\nthough cgroup local storage at runtime still follows the caller\u0027s\ncontext, that is, A -\u003e B(no storage) -\u003e C(storage) path.\n\nRequiring exact cookie equality would break the legitimate case of a\nstorage-less leaf program being tail called from a storage-using one.\nInstead, only accept a zero storage cookie if the program cannot\nperform tail calls itself. This keeps A -\u003e B(no storage) working\nwhile rejecting the A -\u003e B(no storage) -\u003e C(storage) bridge."
          }
        ],
        "id": "CVE-2026-74305",
        "lastModified": "2026-08-17T06:19:24.653",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:30.190",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/10627ddc0167aab5c1c390a10ef461e9937aba08"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1c762d28698483ce7c372091f34d86e4d4828652"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/46fbafe3d2d569d828e8d24a7dbe1659f63685cf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/87177497cca90bf4fcfb759eb898560eb5b46a10"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9ca06849c4239aa2d580c54651f8588c51cb398b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cb22dc79528eb26a46d346c3118dbd6b14c70609"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eb73056ce2a6f101ddd3bdba89af6b24ebffff85"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T20:41:11+00:00",
      "cve": "CVE-2026-74305",
      "id": "CVE-2026-74305",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "182",
      "product_status:known_not_affected": "92",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Tighten cgroup storage cookie checks for prog arrays",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74305.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.