CVE-2026-74540 (GCVE-0-2026-74540)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:38
VLAI
Title
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp l2cap_le_connect_rsp() obtains a channel via __l2cap_get_chan_by_ident() but neither holds a reference nor uses l2cap_chan_hold_unless_zero() before locking and operating on it. A concurrent l2cap_chan_del() triggered by a remote disconnect can free the channel between the lookup and l2cap_chan_lock(), causing a use-after-free. The BR/EDR counterpart l2cap_connect_rsp() and the sibling handler l2cap_le_command_rej() already use l2cap_chan_hold_unless_zero() to safely hold a reference, but l2cap_le_connect_rsp() was left unprotected. Fix by adding l2cap_chan_hold_unless_zero() after the ident lookup and l2cap_chan_put() on the exit path, consistent with other L2CAP response handlers.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f1496dee9cbde2a62821f4441dadb0d3360f60c3 , < 15d6c2367217a6a20b1abae9f38ded716bf620f1 (git)
Affected: f1496dee9cbde2a62821f4441dadb0d3360f60c3 , < 1818180fe12d6cec7a437bc59cde8efdf6b10250 (git)
Affected: f1496dee9cbde2a62821f4441dadb0d3360f60c3 , < 8325eafb38c3dee5af329266393763693d17381b (git)
Affected: f1496dee9cbde2a62821f4441dadb0d3360f60c3 , < fd4c1e301bdec60a40728ea37de531cbccda501a (git)
Affected: f1496dee9cbde2a62821f4441dadb0d3360f60c3 , < 522b730c62c53a1981604fd73524697fd347830d (git)
Affected: f1496dee9cbde2a62821f4441dadb0d3360f60c3 , < 58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136 (git)
Affected: f1496dee9cbde2a62821f4441dadb0d3360f60c3 , < 09f447accc2570751e7d17f0dc0788b40d3edade (git)
Affected: f1496dee9cbde2a62821f4441dadb0d3360f60c3 , < c4740e7f23ff9a8210198d8b4703259e21b9f69d (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.14
Unaffected: 0 , < 3.14 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "15d6c2367217a6a20b1abae9f38ded716bf620f1",
              "status": "affected",
              "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
              "versionType": "git"
            },
            {
              "lessThan": "1818180fe12d6cec7a437bc59cde8efdf6b10250",
              "status": "affected",
              "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
              "versionType": "git"
            },
            {
              "lessThan": "8325eafb38c3dee5af329266393763693d17381b",
              "status": "affected",
              "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
              "versionType": "git"
            },
            {
              "lessThan": "fd4c1e301bdec60a40728ea37de531cbccda501a",
              "status": "affected",
              "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
              "versionType": "git"
            },
            {
              "lessThan": "522b730c62c53a1981604fd73524697fd347830d",
              "status": "affected",
              "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
              "versionType": "git"
            },
            {
              "lessThan": "58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136",
              "status": "affected",
              "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
              "versionType": "git"
            },
            {
              "lessThan": "09f447accc2570751e7d17f0dc0788b40d3edade",
              "status": "affected",
              "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
              "versionType": "git"
            },
            {
              "lessThan": "c4740e7f23ff9a8210198d8b4703259e21b9f69d",
              "status": "affected",
              "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp\n\nl2cap_le_connect_rsp() obtains a channel via\n__l2cap_get_chan_by_ident() but neither holds a reference nor uses\nl2cap_chan_hold_unless_zero() before locking and operating on it.\nA concurrent l2cap_chan_del() triggered by a remote disconnect can\nfree the channel between the lookup and l2cap_chan_lock(), causing\na use-after-free.\n\nThe BR/EDR counterpart l2cap_connect_rsp() and the sibling handler\nl2cap_le_command_rej() already use l2cap_chan_hold_unless_zero()\nto safely hold a reference, but l2cap_le_connect_rsp() was left\nunprotected.\n\nFix by adding l2cap_chan_hold_unless_zero() after the ident lookup\nand l2cap_chan_put() on the exit path, consistent with other L2CAP\nresponse handlers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerability is reached when the kernel processes an incoming L2CAP LE Connect Response over an established Bluetooth LE ACL link (HCI ACL receive \u2192 l2cap_recv_acldata \u2192 l2cap_le_sig_channel \u2192 l2cap_le_connect_rsp), requiring radio proximity rather than routable Internet access.\nAC:L - The remote Bluetooth peer controls both sides of the race by sending L2CAP_LE_CONN_RSP while concurrently triggering channel teardown via L2CAP DISCONN_REQ or HCI disconnect, freeing the channel between __l2cap_get_chan_by_ident() and l2cap_chan_lock() without attacker-uncontrollable timing.\nPR:N - No local privileges on the victim are required; exploitation needs only a nearby attacker with an established LE Bluetooth connection sending crafted L2CAP signaling packets, with no root, CAP_NET_ADMIN, or user-namespace capability on the target host.\nUI:N - On phones, wearables, automotive, and IoT deployments, paired or background Bluetooth clients routinely auto-initiate L2CAP credit-based connections without per-attack user confirmation once an LE link is up, enabling trigger of the pending outgoing connect path.\nS:U - Impact is confined to kernel memory and privileges on the Bluetooth-connected host; there is no VM guest-to-host escape, sandbox breakout, or IOMMU/DMA boundary crossing, so security scope remains unchanged per kernel CVSS guidance.\nC:H - Use-after-free of heap-allocated struct l2cap_chan allows attacker-controlled reuse of freed slab memory, enabling disclosure of kernel heap contents and pointers through corrupted channel fields accessed after premature free.\nI:H - The UAF window writes channel state (ident, dcid, mtu, credits) and invokes chan-\u003eops function pointers (ready, teardown) on freed memory, enabling heap spraying and control-flow hijack for arbitrary kernel code execution.\nA:H - Operating on a freed l2cap_chan can immediately kernel-oops or panic from corrupt mutex/state during lock/unlock and callback dispatch; UAF in softirq L2CAP processing inherently threatens full system availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:38:32.306Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/15d6c2367217a6a20b1abae9f38ded716bf620f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/1818180fe12d6cec7a437bc59cde8efdf6b10250"
        },
        {
          "url": "https://git.kernel.org/stable/c/8325eafb38c3dee5af329266393763693d17381b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd4c1e301bdec60a40728ea37de531cbccda501a"
        },
        {
          "url": "https://git.kernel.org/stable/c/522b730c62c53a1981604fd73524697fd347830d"
        },
        {
          "url": "https://git.kernel.org/stable/c/58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136"
        },
        {
          "url": "https://git.kernel.org/stable/c/09f447accc2570751e7d17f0dc0788b40d3edade"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4740e7f23ff9a8210198d8b4703259e21b9f69d"
        }
      ],
      "title": "Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74540",
    "datePublished": "2026-08-15T12:27:51.522Z",
    "dateReserved": "2026-08-15T05:44:03.913Z",
    "dateUpdated": "2026-08-19T16:38:32.306Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74540",
      "date": "2026-09-21",
      "epss": "0.00255",
      "percentile": "0.17358"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:56:03.000Z",
      "cve": "CVE-2026-74540",
      "id": "msrc_CVE-2026-74540",
      "initial_release_date": "2026-08-23T15:01:24.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74540.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/l2cap_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "15d6c2367217a6a20b1abae9f38ded716bf620f1",
                    "status": "affected",
                    "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1818180fe12d6cec7a437bc59cde8efdf6b10250",
                    "status": "affected",
                    "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8325eafb38c3dee5af329266393763693d17381b",
                    "status": "affected",
                    "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fd4c1e301bdec60a40728ea37de531cbccda501a",
                    "status": "affected",
                    "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "522b730c62c53a1981604fd73524697fd347830d",
                    "status": "affected",
                    "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136",
                    "status": "affected",
                    "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "09f447accc2570751e7d17f0dc0788b40d3edade",
                    "status": "affected",
                    "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c4740e7f23ff9a8210198d8b4703259e21b9f69d",
                    "status": "affected",
                    "version": "f1496dee9cbde2a62821f4441dadb0d3360f60c3",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/l2cap_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.14"
                  },
                  {
                    "lessThan": "3.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp\n\nl2cap_le_connect_rsp() obtains a channel via\n__l2cap_get_chan_by_ident() but neither holds a reference nor uses\nl2cap_chan_hold_unless_zero() before locking and operating on it.\nA concurrent l2cap_chan_del() triggered by a remote disconnect can\nfree the channel between the lookup and l2cap_chan_lock(), causing\na use-after-free.\n\nThe BR/EDR counterpart l2cap_connect_rsp() and the sibling handler\nl2cap_le_command_rej() already use l2cap_chan_hold_unless_zero()\nto safely hold a reference, but l2cap_le_connect_rsp() was left\nunprotected.\n\nFix by adding l2cap_chan_hold_unless_zero() after the ident lookup\nand l2cap_chan_put() on the exit path, consistent with other L2CAP\nresponse handlers."
          }
        ],
        "id": "CVE-2026-74540",
        "lastModified": "2026-08-19T17:21:09.300",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:17:59.337",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/09f447accc2570751e7d17f0dc0788b40d3edade"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/15d6c2367217a6a20b1abae9f38ded716bf620f1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1818180fe12d6cec7a437bc59cde8efdf6b10250"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/522b730c62c53a1981604fd73524697fd347830d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8325eafb38c3dee5af329266393763693d17381b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c4740e7f23ff9a8210198d8b4703259e21b9f69d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fd4c1e301bdec60a40728ea37de531cbccda501a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-21T11:33:22+00:00",
      "cve": "CVE-2026-74540",
      "id": "CVE-2026-74540",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74540.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-10T02:00:35Z",
      "cve": "CVE-2026-74540",
      "id": "CVE-2026-74540",
      "initial_release_date": "2026-08-15T23:50:43Z",
      "product_status:known_affected": "265",
      "product_status:known_not_affected": "97",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74540",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74540.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.