CVE-2026-97595 (GCVE-0-2026-97595)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:22 – Updated: 2026-09-25 14:41
VLAI
Title
mac802154: fix use-after-free of sdata via queued RX frames
Summary
In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee802154_subif_frame() queues received beacon and MAC-command frames onto local->rx_beacon_list / rx_mac_cmd_list and schedules a process-context worker, storing a raw mac_pkt->sdata (and skb->dev == sdata->dev) with neither a reference nor any locking: - the lists have no lock: the softirq producer list_add_tail()s while the mac_wq worker list_del()s, so sibling interfaces on the same phy corrupt the list; - the workers dereference the interface after it may have been freed. mac802154_rx_mac_cmd_worker() touches mac_pkt->sdata directly, and mac802154_rx_beacon_worker() -> mac802154_process_beacon() dereferences skb->dev (== sdata->dev). Removing an interface frees its sdata (netdev_priv) while a queued frame still points at it, so a later worker run is a use-after-free. Reproduced under KASAN by flooding a victim interface with MAC command frames and removing it (the beacon path is the same class via skb->dev): BUG: KASAN: slab-use-after-free in mac802154_rx_mac_cmd_worker+0x463/0x630 [mac802154] Read of size 4 at addr ffff888002f9ea18 by task kworker/u8:1/31 Workqueue: phy0-mac-cmds mac802154_rx_mac_cmd_worker [mac802154] Call Trace: mac802154_rx_mac_cmd_worker+0x463/0x630 [mac802154] process_one_work+0x611/0xe80 worker_thread+0x52e/0xdc0 kthread+0x30c/0x630 ret_from_fork+0x2fd/0x3e0 Fix both lists together: - add local->rx_lock and take it around every list access: the softirq producer (plain spin_lock, softirq context) and the workers and flush (spin_lock_bh, process context); - pin the interface for the lifetime of a queued frame with netdev_hold()/netdev_put(), so the worker can safely dereference sdata / skb->dev even while the interface is being removed; - dequeue under the lock at the head and loop-drain the whole list in the workers (they previously processed one frame per run and relied on a later enqueue to drain the rest); - drop not-yet-started frames of an interface before it is unregistered, from ieee802154_if_remove() (after the RCU grace period) and from the ieee802154_remove_interfaces() loop -- the latter is the whole-phy teardown path, which does not go through ieee802154_if_remove(). An in-flight worker that already dequeued a frame keeps its own netdev reference; unregister_netdevice() then waits it out in netdev_run_todo(), which runs at rtnl_unlock() (rtnl released) and after the interface has been closed, so it does not pin rtnl. A worker blocked in an association TX only delays that one interface's unregister (the usual "waiting for %s to become free"), it does not hold rtnl. netdev_hold() is used for this reason instead of a cancel_work_sync() under rtnl, which would block on the worker's unbounded MLME TX wait via ieee802154_sync_queue(). The mac-command worker additionally skips processing for a stopped interface (ieee802154_sdata_running()), avoiding a needless association response during teardown.
Severity
7.5 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 57588c71177f0bfc08509c2c3a9bfe32850c0786 , < 4740ef0518c5e3bf31ebfb2288a6ac3b462ead06 (git)
Affected: 57588c71177f0bfc08509c2c3a9bfe32850c0786 , < 07f0214018d7241e3610c1be984c8abfce16c099 (git)
Affected: 57588c71177f0bfc08509c2c3a9bfe32850c0786 , < 3d1fde35f95d7f02a7dc473c51d81e8d9e992cfc (git)
Affected: 57588c71177f0bfc08509c2c3a9bfe32850c0786 , < 2f37fba846c9fdff5fc15b6d93656057ccd13031 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/cfg802154.h",
            "net/mac802154/ieee802154_i.h",
            "net/mac802154/iface.c",
            "net/mac802154/main.c",
            "net/mac802154/rx.c",
            "net/mac802154/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4740ef0518c5e3bf31ebfb2288a6ac3b462ead06",
              "status": "affected",
              "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
              "versionType": "git"
            },
            {
              "lessThan": "07f0214018d7241e3610c1be984c8abfce16c099",
              "status": "affected",
              "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
              "versionType": "git"
            },
            {
              "lessThan": "3d1fde35f95d7f02a7dc473c51d81e8d9e992cfc",
              "status": "affected",
              "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
              "versionType": "git"
            },
            {
              "lessThan": "2f37fba846c9fdff5fc15b6d93656057ccd13031",
              "status": "affected",
              "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/cfg802154.h",
            "net/mac802154/ieee802154_i.h",
            "net/mac802154/iface.c",
            "net/mac802154/main.c",
            "net/mac802154/rx.c",
            "net/mac802154/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix use-after-free of sdata via queued RX frames\n\nThe RX softirq producer ieee802154_subif_frame() queues received beacon\nand MAC-command frames onto local-\u003erx_beacon_list / rx_mac_cmd_list and\nschedules a process-context worker, storing a raw mac_pkt-\u003esdata (and\nskb-\u003edev == sdata-\u003edev) with neither a reference nor any locking:\n\n - the lists have no lock: the softirq producer list_add_tail()s while the\n   mac_wq worker list_del()s, so sibling interfaces on the same phy corrupt\n   the list;\n\n - the workers dereference the interface after it may have been freed.\n   mac802154_rx_mac_cmd_worker() touches mac_pkt-\u003esdata directly, and\n   mac802154_rx_beacon_worker() -\u003e mac802154_process_beacon() dereferences\n   skb-\u003edev (== sdata-\u003edev). Removing an interface frees its sdata\n   (netdev_priv) while a queued frame still points at it, so a later worker\n   run is a use-after-free.\n\nReproduced under KASAN by flooding a victim interface with MAC command\nframes and removing it (the beacon path is the same class via skb-\u003edev):\n\n  BUG: KASAN: slab-use-after-free in mac802154_rx_mac_cmd_worker+0x463/0x630 [mac802154]\n  Read of size 4 at addr ffff888002f9ea18 by task kworker/u8:1/31\n  Workqueue: phy0-mac-cmds mac802154_rx_mac_cmd_worker [mac802154]\n  Call Trace:\n   mac802154_rx_mac_cmd_worker+0x463/0x630 [mac802154]\n   process_one_work+0x611/0xe80\n   worker_thread+0x52e/0xdc0\n   kthread+0x30c/0x630\n   ret_from_fork+0x2fd/0x3e0\n\nFix both lists together:\n\n - add local-\u003erx_lock and take it around every list access: the softirq\n   producer (plain spin_lock, softirq context) and the workers and flush\n   (spin_lock_bh, process context);\n\n - pin the interface for the lifetime of a queued frame with\n   netdev_hold()/netdev_put(), so the worker can safely dereference sdata /\n   skb-\u003edev even while the interface is being removed;\n\n - dequeue under the lock at the head and loop-drain the whole list in the\n   workers (they previously processed one frame per run and relied on a\n   later enqueue to drain the rest);\n\n - drop not-yet-started frames of an interface before it is unregistered,\n   from ieee802154_if_remove() (after the RCU grace period) and from the\n   ieee802154_remove_interfaces() loop -- the latter is the whole-phy\n   teardown path, which does not go through ieee802154_if_remove().\n\nAn in-flight worker that already dequeued a frame keeps its own netdev\nreference; unregister_netdevice() then waits it out in netdev_run_todo(),\nwhich runs at rtnl_unlock() (rtnl released) and after the interface has\nbeen closed, so it does not pin rtnl. A worker blocked in an association\nTX only delays that one interface\u0027s unregister (the usual \"waiting for %s\nto become free\"), it does not hold rtnl. netdev_hold() is used for this\nreason instead of a cancel_work_sync() under rtnl, which would block on\nthe worker\u0027s unbounded MLME TX wait via ieee802154_sync_queue().\n\nThe mac-command worker additionally skips processing for a stopped\ninterface (ieee802154_sdata_running()), avoiding a needless association\nresponse during teardown."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - ieee802154_subif_frame() queues every received IEEE 802.15.4 MAC command frame (and beacons during a scan) onto local-\u003erx_mac_cmd_list/rx_beacon_list from the RX tasklet with no lock, so a sender in radio range supplies the frames that race the mac_wq worker; 802.15.4 is a radio link, so this is adjacent rather than network.\nAC:H - A remote attacker only reaches the bug by making the tasklet\u0027s unlocked list_add_tail() collide with the worker\u0027s list_del() on another CPU. They control the flood but not the worker\u0027s timing, and the window is a few pointer writes. The use-after-free of sdata also needs an interface removal that the remote attacker cannot cause.\nPR:N - __ieee802154_rx_handle_packet() hands every parsed frame to each running non-monitor interface, and ieee802154_subif_frame() queues MAC command frames with no association or scan state required; unsecured frames pass mac802154_llsec_decrypt(), so no credentials are needed.\nUI:N - The victim only needs a running 802.15.4 interface, which is its normal operating state; the attacker sends the frames and the kernel queues and processes them without any user action.\nS:U - The corruption stays within the host kernel (mac802154 RX lists, cfg802154_mac_pkt, netdev_priv sdata) and crosses no VM or IOMMU boundary.\nC:H - A corrupted rx_mac_cmd_list or rx_beacon_list lets the worker dereference freed cfg802154_mac_pkt entries, their skb and sdata. Reclaimed slab contents are then read as kernel pointers, a use-after-free read that can disclose kernel memory.\nI:H - The worker does list_del(), kfree() and kfree_skb() on stale mac_pkt entries, and mac802154_process_association_req/resp() write through the freed sdata, giving write and double-free primitives on reclaimable slab memory.\nA:H - List corruption or the sdata use-after-free in mac802154_rx_mac_cmd_worker() or mac802154_rx_beacon_worker() causes a kernel oops; the commit\u0027s KASAN report shows such a slab-use-after-free."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:28.874Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4740ef0518c5e3bf31ebfb2288a6ac3b462ead06"
        },
        {
          "url": "https://git.kernel.org/stable/c/07f0214018d7241e3610c1be984c8abfce16c099"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d1fde35f95d7f02a7dc473c51d81e8d9e992cfc"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f37fba846c9fdff5fc15b6d93656057ccd13031"
        }
      ],
      "title": "mac802154: fix use-after-free of sdata via queued RX frames",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97595",
    "datePublished": "2026-09-25T10:22:11.134Z",
    "dateReserved": "2026-09-24T16:01:01.157Z",
    "dateUpdated": "2026-09-25T14:41:28.874Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97595",
      "date": "2026-09-28",
      "epss": "0.0027",
      "percentile": "0.17289"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-28T00:27:18.000Z",
      "cve": "CVE-2026-97595",
      "id": "msrc_CVE-2026-97595",
      "initial_release_date": "2026-09-28T00:27:18.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mac802154: fix use-after-free of sdata via queued RX frames",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-97595.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/cfg802154.h",
                  "net/mac802154/ieee802154_i.h",
                  "net/mac802154/iface.c",
                  "net/mac802154/main.c",
                  "net/mac802154/rx.c",
                  "net/mac802154/scan.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4740ef0518c5e3bf31ebfb2288a6ac3b462ead06",
                    "status": "affected",
                    "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "07f0214018d7241e3610c1be984c8abfce16c099",
                    "status": "affected",
                    "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3d1fde35f95d7f02a7dc473c51d81e8d9e992cfc",
                    "status": "affected",
                    "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2f37fba846c9fdff5fc15b6d93656057ccd13031",
                    "status": "affected",
                    "version": "57588c71177f0bfc08509c2c3a9bfe32850c0786",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/cfg802154.h",
                  "net/mac802154/ieee802154_i.h",
                  "net/mac802154/iface.c",
                  "net/mac802154/main.c",
                  "net/mac802154/rx.c",
                  "net/mac802154/scan.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.3"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix use-after-free of sdata via queued RX frames\n\nThe RX softirq producer ieee802154_subif_frame() queues received beacon\nand MAC-command frames onto local-\u003erx_beacon_list / rx_mac_cmd_list and\nschedules a process-context worker, storing a raw mac_pkt-\u003esdata (and\nskb-\u003edev == sdata-\u003edev) with neither a reference nor any locking:\n\n - the lists have no lock: the softirq producer list_add_tail()s while the\n   mac_wq worker list_del()s, so sibling interfaces on the same phy corrupt\n   the list;\n\n - the workers dereference the interface after it may have been freed.\n   mac802154_rx_mac_cmd_worker() touches mac_pkt-\u003esdata directly, and\n   mac802154_rx_beacon_worker() -\u003e mac802154_process_beacon() dereferences\n   skb-\u003edev (== sdata-\u003edev). Removing an interface frees its sdata\n   (netdev_priv) while a queued frame still points at it, so a later worker\n   run is a use-after-free.\n\nReproduced under KASAN by flooding a victim interface with MAC command\nframes and removing it (the beacon path is the same class via skb-\u003edev):\n\n  BUG: KASAN: slab-use-after-free in mac802154_rx_mac_cmd_worker+0x463/0x630 [mac802154]\n  Read of size 4 at addr ffff888002f9ea18 by task kworker/u8:1/31\n  Workqueue: phy0-mac-cmds mac802154_rx_mac_cmd_worker [mac802154]\n  Call Trace:\n   mac802154_rx_mac_cmd_worker+0x463/0x630 [mac802154]\n   process_one_work+0x611/0xe80\n   worker_thread+0x52e/0xdc0\n   kthread+0x30c/0x630\n   ret_from_fork+0x2fd/0x3e0\n\nFix both lists together:\n\n - add local-\u003erx_lock and take it around every list access: the softirq\n   producer (plain spin_lock, softirq context) and the workers and flush\n   (spin_lock_bh, process context);\n\n - pin the interface for the lifetime of a queued frame with\n   netdev_hold()/netdev_put(), so the worker can safely dereference sdata /\n   skb-\u003edev even while the interface is being removed;\n\n - dequeue under the lock at the head and loop-drain the whole list in the\n   workers (they previously processed one frame per run and relied on a\n   later enqueue to drain the rest);\n\n - drop not-yet-started frames of an interface before it is unregistered,\n   from ieee802154_if_remove() (after the RCU grace period) and from the\n   ieee802154_remove_interfaces() loop -- the latter is the whole-phy\n   teardown path, which does not go through ieee802154_if_remove().\n\nAn in-flight worker that already dequeued a frame keeps its own netdev\nreference; unregister_netdevice() then waits it out in netdev_run_todo(),\nwhich runs at rtnl_unlock() (rtnl released) and after the interface has\nbeen closed, so it does not pin rtnl. A worker blocked in an association\nTX only delays that one interface\u0027s unregister (the usual \"waiting for %s\nto become free\"), it does not hold rtnl. netdev_hold() is used for this\nreason instead of a cancel_work_sync() under rtnl, which would block on\nthe worker\u0027s unbounded MLME TX wait via ieee802154_sync_queue().\n\nThe mac-command worker additionally skips processing for a stopped\ninterface (ieee802154_sdata_running()), avoiding a needless association\nresponse during teardown."
          }
        ],
        "id": "CVE-2026-97595",
        "lastModified": "2026-09-25T15:18:00.797",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:10.770",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/07f0214018d7241e3610c1be984c8abfce16c099"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2f37fba846c9fdff5fc15b6d93656057ccd13031"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3d1fde35f95d7f02a7dc473c51d81e8d9e992cfc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4740ef0518c5e3bf31ebfb2288a6ac3b462ead06"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.