CVE-2026-92485 (GCVE-0-2026-92485)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:10 – Updated: 2026-10-30 12:35
VLAI
Title
bpf: Fix WARNING in bpf_tracing_link_release
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARNING in bpf_tracing_link_release The trampoline could be corrupted by the blindly 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier. 1. A fexit attached to a tail_call_reachable prog. 'tr->flags' became 'BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX'. And, the trampoline would poke the target prog's nop insn using jmp insn instead of call insn. 2. Another fexit loaded with the same tail_call_reachable prog target. 'tr->flags' became 'BPF_TRAMP_F_TAIL_CALL_CTX'. 3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in 'tr->flags', the trampoline will fail to restore the prog's nop insn using call insn. [ 3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98 ... [ 3.428793] bpf_link_free+0x58/0x130 [ 3.429293] bpf_link_release+0x23/0x30 Fix the warning by updating 'tr->flags' with '|=' and lock.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6641 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 605c8d8f9966fcd2f0b858fabebe416fc83f2209 , < 1757598b3804f7cb35b5b5e02558f6d8b9c2f254 (git)
Affected: 8f873cc3f67f2257493063e57d0caf07ef889ee9 , < a5c6316052f0ff1467221ecf2996cbab0a496b1e (git)
Affected: 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 , < d02035c5eb4955616efc5c6dbe3d98f19d798cb2 (git)
Affected: 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 , < 094f0a895cf97a993d06d5dc4c12e7cb7da845a5 (git)
Affected: 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 , < 48a0209d8da0d90a7b0a0db19d1ff88027b13781 (git)
Affected: 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 , < 61aaa8782bec59ecffd22e030f54ef9351bcabf9 (git)
Affected: 028480eaf2a1401e914a1fa1a4a21d877cf0ae30 (git)
Affected: 6.1.72 , < 6.1.191 (semver)
Affected: 6.6.2 , < 6.6.160 (semver)
Affected: 6.5.12 , < 6.6 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.1.191 , ≤ 6.1.* (semver)
Unaffected: 6.6.160 , ≤ 6.6.* (semver)
Unaffected: 6.12.114 , ≤ 6.12.* (semver)
Unaffected: 6.18.57 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/trampoline.c",
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1757598b3804f7cb35b5b5e02558f6d8b9c2f254",
              "status": "affected",
              "version": "605c8d8f9966fcd2f0b858fabebe416fc83f2209",
              "versionType": "git"
            },
            {
              "lessThan": "a5c6316052f0ff1467221ecf2996cbab0a496b1e",
              "status": "affected",
              "version": "8f873cc3f67f2257493063e57d0caf07ef889ee9",
              "versionType": "git"
            },
            {
              "lessThan": "d02035c5eb4955616efc5c6dbe3d98f19d798cb2",
              "status": "affected",
              "version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
              "versionType": "git"
            },
            {
              "lessThan": "094f0a895cf97a993d06d5dc4c12e7cb7da845a5",
              "status": "affected",
              "version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
              "versionType": "git"
            },
            {
              "lessThan": "48a0209d8da0d90a7b0a0db19d1ff88027b13781",
              "status": "affected",
              "version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
              "versionType": "git"
            },
            {
              "lessThan": "61aaa8782bec59ecffd22e030f54ef9351bcabf9",
              "status": "affected",
              "version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "028480eaf2a1401e914a1fa1a4a21d877cf0ae30",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.191",
              "status": "affected",
              "version": "6.1.72",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.160",
              "status": "affected",
              "version": "6.6.2",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6",
              "status": "affected",
              "version": "6.5.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/trampoline.c",
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "6.1.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "6.6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix WARNING in bpf_tracing_link_release\n\nThe trampoline could be corrupted by the blindly\n\u0027tr-\u003eflags = BPF_TRAMP_F_TAIL_CALL_CTX\u0027 in verifier.\n\n1. A fexit attached to a tail_call_reachable prog. \u0027tr-\u003eflags\u0027 became\n   \u0027BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX\u0027. And, the\n   trampoline would poke the target prog\u0027s nop insn using jmp insn instead\n   of call insn.\n2. Another fexit loaded with the same tail_call_reachable prog target.\n   \u0027tr-\u003eflags\u0027 became \u0027BPF_TRAMP_F_TAIL_CALL_CTX\u0027.\n3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in\n   \u0027tr-\u003eflags\u0027, the trampoline will fail to restore the prog\u0027s nop insn\n   using call insn.\n\n[    3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98\n...\n[    3.428793]  bpf_link_free+0x58/0x130\n[    3.429293]  bpf_link_release+0x23/0x30\n\nFix the warning by updating \u0027tr-\u003eflags\u0027 with \u0027|=\u0027 and lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The trigger is local bpf() only: BPF_PROG_LOAD of a tail_call_reachable target plus two BPF_TRACE_FEXIT programs (check_attach_btf_id overwrites tr-\u003eflags), BPF_LINK_CREATE via bpf_tracing_prog_attach, then close() of the first link into bpf_tracing_link_release. No remote protocol carries the malformed state.\nAC:L - After the first fexit attach, bpf_trampoline_update sets BPF_TRAMP_F_CALL_ORIG and bpf_arch_text_poke installs a JMP (bpf_trampoline_use_jmp). A second BPF_PROG_LOAD then does tr-\u003eflags = BPF_TRAMP_F_TAIL_CALL_CTX in check_attach_btf_id; closing the first link hits the JMP-vs-CALL mismatch. The attacker owns both loads and the close; CONFIG_DYNAMIC_FTRACE_WITH_JMP is def_bool y on x86_64.\nPR:L - bpf_prog_load() of BPF_PROG_TYPE_TRACING/BPF_TRACE_FEXIT requires CAP_BPF and, via is_perfmon_prog_type(), CAP_PERFMON; bpf_token_capable() with a delegated BPF token grants those into a non-init user namespace, so this is not init-namespace root.\nUI:N - The attacker loads both fexit programs, attaches the first with BPF_LINK_CREATE/bpf_tracing_prog_attach, and closes that link fd themselves; no victim mount, open, or other action is required.\nS:U - The leftover JMP in the target program and the use-after-free of fexit1\u0027s JIT image stay inside host kernel BPF trampoline code; they do not cross a VM, IOMMU, or sandbox boundary.\nC:H - Failed bpf_trampoline_unlink_prog() leaves the target\u0027s 5-byte slot as a JMP into the trampoline image that still calls fexit1-\u003ebpf_func, while bpf_link_free()\u2192bpf_link_dealloc() immediately bpf_prog_put()s fexit1 (no dealloc_deferred). After bpf_jit_free(), later target invocations read that freed executable image.\nI:H - The same dangling trampoline CALL into fexit1\u0027s freed JIT pages is an executable use-after-free; the attacker controls the fexit program and can spray replacement JIT text at that address, hijacking kernel control flow when the target program runs.\nA:H - bpf_tracing_link_release() WARN_ON_ONCE()s the failed bpf_trampoline_unlink_prog() after bpf_arch_text_poke() rejects the JMP-vs-CALL restore. Running the target afterward jumps to the trampoline and calls the freed fexit JIT, causing a kernel paging fault/oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:35:38.840Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1757598b3804f7cb35b5b5e02558f6d8b9c2f254"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5c6316052f0ff1467221ecf2996cbab0a496b1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/d02035c5eb4955616efc5c6dbe3d98f19d798cb2"
        },
        {
          "url": "https://git.kernel.org/stable/c/094f0a895cf97a993d06d5dc4c12e7cb7da845a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/48a0209d8da0d90a7b0a0db19d1ff88027b13781"
        },
        {
          "url": "https://git.kernel.org/stable/c/61aaa8782bec59ecffd22e030f54ef9351bcabf9"
        }
      ],
      "title": "bpf: Fix WARNING in bpf_tracing_link_release",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-92485",
    "datePublished": "2026-09-17T16:10:00.999Z",
    "dateReserved": "2026-09-16T12:21:13.870Z",
    "dateUpdated": "2026-10-30T12:35:38.840Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-92485",
      "date": "2026-11-12",
      "epss": "0.00165",
      "percentile": "0.05755"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/bpf.h",
                  "kernel/bpf/trampoline.c",
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1757598b3804f7cb35b5b5e02558f6d8b9c2f254",
                    "status": "affected",
                    "version": "605c8d8f9966fcd2f0b858fabebe416fc83f2209",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a5c6316052f0ff1467221ecf2996cbab0a496b1e",
                    "status": "affected",
                    "version": "8f873cc3f67f2257493063e57d0caf07ef889ee9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d02035c5eb4955616efc5c6dbe3d98f19d798cb2",
                    "status": "affected",
                    "version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "094f0a895cf97a993d06d5dc4c12e7cb7da845a5",
                    "status": "affected",
                    "version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "48a0209d8da0d90a7b0a0db19d1ff88027b13781",
                    "status": "affected",
                    "version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "61aaa8782bec59ecffd22e030f54ef9351bcabf9",
                    "status": "affected",
                    "version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "028480eaf2a1401e914a1fa1a4a21d877cf0ae30",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1.191",
                    "status": "affected",
                    "version": "6.1.72",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.160",
                    "status": "affected",
                    "version": "6.6.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "affected",
                    "version": "6.5.12",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/bpf.h",
                  "kernel/bpf/trampoline.c",
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.191",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.160",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.114",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.57",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix WARNING in bpf_tracing_link_release\n\nThe trampoline could be corrupted by the blindly\n\u0027tr-\u003eflags = BPF_TRAMP_F_TAIL_CALL_CTX\u0027 in verifier.\n\n1. A fexit attached to a tail_call_reachable prog. \u0027tr-\u003eflags\u0027 became\n   \u0027BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX\u0027. And, the\n   trampoline would poke the target prog\u0027s nop insn using jmp insn instead\n   of call insn.\n2. Another fexit loaded with the same tail_call_reachable prog target.\n   \u0027tr-\u003eflags\u0027 became \u0027BPF_TRAMP_F_TAIL_CALL_CTX\u0027.\n3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in\n   \u0027tr-\u003eflags\u0027, the trampoline will fail to restore the prog\u0027s nop insn\n   using call insn.\n\n[    3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98\n...\n[    3.428793]  bpf_link_free+0x58/0x130\n[    3.429293]  bpf_link_release+0x23/0x30\n\nFix the warning by updating \u0027tr-\u003eflags\u0027 with \u0027|=\u0027 and lock."
          }
        ],
        "id": "CVE-2026-92485",
        "lastModified": "2026-10-30T13:20:55.017",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:50.590",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/094f0a895cf97a993d06d5dc4c12e7cb7da845a5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1757598b3804f7cb35b5b5e02558f6d8b9c2f254"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/48a0209d8da0d90a7b0a0db19d1ff88027b13781"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/61aaa8782bec59ecffd22e030f54ef9351bcabf9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a5c6316052f0ff1467221ecf2996cbab0a496b1e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d02035c5eb4955616efc5c6dbe3d98f19d798cb2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-06T01:48:50+00:00",
      "cve": "CVE-2026-92485",
      "id": "CVE-2026-92485",
      "initial_release_date": "2026-09-17T00:00:00+00:00",
      "product_status:known_affected": "110",
      "product_status:known_not_affected": "93",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Fix WARNING in bpf_tracing_link_release",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92485.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-20T00:32:28Z",
      "cve": "CVE-2026-92485",
      "id": "CVE-2026-92485",
      "initial_release_date": "2026-09-18T00:13:52Z",
      "product_status:known_affected": "81",
      "product_status:known_not_affected": "267",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-92485",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-92485.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.