CVE-2026-98216 (GCVE-0-2026-98216)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:44 – Updated: 2026-10-07 06:49
VLAI
Title
IB/hfi1: Fix the PIO_CRED credit-return mmap
Summary
In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix the PIO_CRED credit-return mmap hfi1_file_mmap()'s PIO_CRED case must hand user space the single credit-return page that holds this context's entry. That page is the second or third page of the per-node credit-return allocation once the hardware send context index reaches 64 or 128, so the failure below is intermittent: when the entry lands on the first page the offset is zero and everything works. Two things are wrong. First, cr_page_offset is a byte offset but .va is a struct credit_return *, so adding it is pointer arithmetic and scales the offset by sizeof(struct credit_return) == 64. memvirt then lands 256 KiB or 512 KiB past a 10240-byte allocation. With an IOMMU translating, that address is inside the vmalloc range but in no vm_area, so dma_mmap_coherent() -> iommu_dma_mmap() finds no pages, vmalloc_to_pfn() returns page_to_pfn(NULL), and remap_pfn_range() installs a frame above MAXPHYADDR. The first user read then takes: psm2_ep_open_pr: Corrupted page table at address 7a14d007e000 PGD 800000013886a067 P4D 800000013886a067 PUD 13886b067 PMD 13886c067 PTE 800049168e911235 Oops: Bad pagetable: 000d [#1] SMP PTI Second, and still wrong once the arithmetic is corrected, dma_mmap_coherent() describes a whole coherent buffer and selects the page within it with vma->vm_pgoff. Offsetting cpu_addr has no effect: for a vmap'd allocation iommu_dma_mmap() uses cpu_addr only to locate the vm_area and then maps pages[vm_pgoff], which hfi1_file_mmap() has just set to 0. User space therefore always receives the first credit-return page, every credit read is for the wrong context, and send PIO stalls forever. Use the DMA API as intended: pass the base of the allocation with its full length and select the page with vm_pgoff. A separate length is needed because memlen must keep describing the VMA for the existing size check. The dma-direct path stays correct as well, since dma_direct_mmap() adds the same vm_pgoff to the base pfn. Tested on a Dell T7610 (Xeon E5-2650 v2, Intel IOMMU in DMA-FQ mode) against a Threadripper PRO 3995WX peer, both Omni-Path 100. Before this change psm2_ep_open() Oopses the kernel; with only the arithmetic corrected psm2_ep_open() succeeds but any transfer that uses send PIO hangs, PSM2_SDMA=2 (send PIO disabled) completing normally while PSM2_SDMA=0 (send PIO only) hangs every time. With this change send PIO, send DMA and the default mixed mode all work.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 54/100 over 6633 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1ec82317a1daac78c04b0c15af89018ccf9fa2b7 , < 535530bb2ea5254e1e9f55280143d262dd065204 (git)
Affected: 1ec82317a1daac78c04b0c15af89018ccf9fa2b7 , < dcebe0b0bb080a25fe08011fd6b6e741f7912f01 (git)
Affected: 1ec82317a1daac78c04b0c15af89018ccf9fa2b7 , < 180752deb7270ad37394ab6ef7cf4978fad040b3 (git)
Affected: 1ec82317a1daac78c04b0c15af89018ccf9fa2b7 , < bafeac9ce5d1ce5256bcf7e5702e831e9aaf419b (git)
Affected: 1ec82317a1daac78c04b0c15af89018ccf9fa2b7 , < 62f0f34fbd2b2d5653d33d3b9d42fdcabb1c0101 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.158 , ≤ 6.6.* (semver)
Unaffected: 6.12.112 , ≤ 6.12.* (semver)
Unaffected: 6.18.54 , ≤ 6.18.* (semver)
Unaffected: 7.2.8 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/hfi1/file_ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "535530bb2ea5254e1e9f55280143d262dd065204",
              "status": "affected",
              "version": "1ec82317a1daac78c04b0c15af89018ccf9fa2b7",
              "versionType": "git"
            },
            {
              "lessThan": "dcebe0b0bb080a25fe08011fd6b6e741f7912f01",
              "status": "affected",
              "version": "1ec82317a1daac78c04b0c15af89018ccf9fa2b7",
              "versionType": "git"
            },
            {
              "lessThan": "180752deb7270ad37394ab6ef7cf4978fad040b3",
              "status": "affected",
              "version": "1ec82317a1daac78c04b0c15af89018ccf9fa2b7",
              "versionType": "git"
            },
            {
              "lessThan": "bafeac9ce5d1ce5256bcf7e5702e831e9aaf419b",
              "status": "affected",
              "version": "1ec82317a1daac78c04b0c15af89018ccf9fa2b7",
              "versionType": "git"
            },
            {
              "lessThan": "62f0f34fbd2b2d5653d33d3b9d42fdcabb1c0101",
              "status": "affected",
              "version": "1ec82317a1daac78c04b0c15af89018ccf9fa2b7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/hfi1/file_ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/hfi1: Fix the PIO_CRED credit-return mmap\n\nhfi1_file_mmap()\u0027s PIO_CRED case must hand user space the single\ncredit-return page that holds this context\u0027s entry.  That page is the\nsecond or third page of the per-node credit-return allocation once the\nhardware send context index reaches 64 or 128, so the failure below is\nintermittent: when the entry lands on the first page the offset is zero\nand everything works.\n\nTwo things are wrong.\n\nFirst, cr_page_offset is a byte offset but .va is a struct\ncredit_return *, so adding it is pointer arithmetic and scales the offset\nby sizeof(struct credit_return) == 64.  memvirt then lands 256 KiB or\n512 KiB past a 10240-byte allocation.  With an IOMMU translating, that\naddress is inside the vmalloc range but in no vm_area, so\ndma_mmap_coherent() -\u003e iommu_dma_mmap() finds no pages, vmalloc_to_pfn()\nreturns page_to_pfn(NULL), and remap_pfn_range() installs a frame above\nMAXPHYADDR.  The first user read then takes:\n\n  psm2_ep_open_pr: Corrupted page table at address 7a14d007e000\n  PGD 800000013886a067 P4D 800000013886a067 PUD 13886b067 PMD 13886c067\n                                            PTE 800049168e911235\n  Oops: Bad pagetable: 000d [#1] SMP PTI\n\nSecond, and still wrong once the arithmetic is corrected,\ndma_mmap_coherent() describes a whole coherent buffer and selects the\npage within it with vma-\u003evm_pgoff.  Offsetting cpu_addr has no effect:\nfor a vmap\u0027d allocation iommu_dma_mmap() uses cpu_addr only to locate the\nvm_area and then maps pages[vm_pgoff], which hfi1_file_mmap() has just\nset to 0.  User space therefore always receives the first credit-return\npage, every credit read is for the wrong context, and send PIO stalls\nforever.\n\nUse the DMA API as intended: pass the base of the allocation with its\nfull length and select the page with vm_pgoff.  A separate length is\nneeded because memlen must keep describing the VMA for the existing size\ncheck.  The dma-direct path stays correct as well, since dma_direct_mmap()\nadds the same vm_pgoff to the base pfn.\n\nTested on a Dell T7610 (Xeon E5-2650 v2, Intel IOMMU in DMA-FQ mode)\nagainst a Threadripper PRO 3995WX peer, both Omni-Path 100.  Before this\nchange psm2_ep_open() Oopses the kernel; with only the arithmetic\ncorrected psm2_ep_open() succeeds but any transfer that uses send PIO\nhangs, PSM2_SDMA=2 (send PIO disabled) completing normally while\nPSM2_SDMA=0 (send PIO only) hangs every time.  With this change send PIO,\nsend DMA and the default mixed mode all work."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bad mapping is created by hfi1_file_mmap() PIO_CRED case, reached by a local process via open() of the /dev/hfi1_N user cdev, the ASSIGN_CTXT ioctl and mmap() of the PIO_CRED token; no remote peer supplies any data to this path.\nAC:L - With IOMMU DMA translation (common on x86 servers), the pointer-scaled cr_page_offset deterministically sends memvirt 256/512 KiB past the credit-return buffer for send context index \u003e=64, and the attacker can raise the index by opening more contexts; the commit\u0027s reproducer oopses every time.\nPR:L - hfi1_user_devnode() creates the user device node with mode 0666 and hfi1_file_open() has no capability check, so any unprivileged local user on an Omni-Path node (e.g. a shared HPC node) can assign a context and issue the mmap.\nUI:N - The attacker triggers the faulty mapping and the faulting read entirely from their own process; no other user or administrator has to do anything.\nS:U - Both impacts stay within the host kernel\u0027s own authority: a kernel page or bogus PFN is mapped into a local process and the kernel oopses; no VM, IOMMU or sandbox boundary is crossed.\nC:H - If the out-of-range vmalloc address lands in a non-DMA-coherent vm_area, iommu_dma_mmap() falls back to vmalloc_to_pfn() and remap_pfn_range() exposes that kernel page to userspace read-only with no reference held, so the user can read unrelated kernel memory, even after it is freed and reused.\nI:N - The PIO_CRED VMA is read-only: VM_WRITE is rejected with -EPERM and VM_MAYWRITE is cleared, so the mis-mapped page cannot be written from userspace, and the bug gives no kernel write primitive.\nA:H - When the address falls in a vmalloc hole, page_to_pfn(NULL) installs a PTE for a frame above MAXPHYADDR and the first user read causes an \u0027Oops: Bad pagetable\u0027 kernel crash; even with the arithmetic fixed, mapping the wrong page leaves send PIO hung forever."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T06:49:30.564Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/535530bb2ea5254e1e9f55280143d262dd065204"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcebe0b0bb080a25fe08011fd6b6e741f7912f01"
        },
        {
          "url": "https://git.kernel.org/stable/c/180752deb7270ad37394ab6ef7cf4978fad040b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/bafeac9ce5d1ce5256bcf7e5702e831e9aaf419b"
        },
        {
          "url": "https://git.kernel.org/stable/c/62f0f34fbd2b2d5653d33d3b9d42fdcabb1c0101"
        }
      ],
      "title": "IB/hfi1: Fix the PIO_CRED credit-return mmap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98216",
    "datePublished": "2026-10-06T08:44:52.288Z",
    "dateReserved": "2026-09-25T10:25:14.326Z",
    "dateUpdated": "2026-10-07T06:49:30.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98216",
      "date": "2026-10-09",
      "epss": "0.00131",
      "percentile": "0.02321"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/hfi1/file_ops.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "535530bb2ea5254e1e9f55280143d262dd065204",
                    "status": "affected",
                    "version": "1ec82317a1daac78c04b0c15af89018ccf9fa2b7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dcebe0b0bb080a25fe08011fd6b6e741f7912f01",
                    "status": "affected",
                    "version": "1ec82317a1daac78c04b0c15af89018ccf9fa2b7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "180752deb7270ad37394ab6ef7cf4978fad040b3",
                    "status": "affected",
                    "version": "1ec82317a1daac78c04b0c15af89018ccf9fa2b7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bafeac9ce5d1ce5256bcf7e5702e831e9aaf419b",
                    "status": "affected",
                    "version": "1ec82317a1daac78c04b0c15af89018ccf9fa2b7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "62f0f34fbd2b2d5653d33d3b9d42fdcabb1c0101",
                    "status": "affected",
                    "version": "1ec82317a1daac78c04b0c15af89018ccf9fa2b7",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/hfi1/file_ops.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.3"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.158",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/hfi1: Fix the PIO_CRED credit-return mmap\n\nhfi1_file_mmap()\u0027s PIO_CRED case must hand user space the single\ncredit-return page that holds this context\u0027s entry.  That page is the\nsecond or third page of the per-node credit-return allocation once the\nhardware send context index reaches 64 or 128, so the failure below is\nintermittent: when the entry lands on the first page the offset is zero\nand everything works.\n\nTwo things are wrong.\n\nFirst, cr_page_offset is a byte offset but .va is a struct\ncredit_return *, so adding it is pointer arithmetic and scales the offset\nby sizeof(struct credit_return) == 64.  memvirt then lands 256 KiB or\n512 KiB past a 10240-byte allocation.  With an IOMMU translating, that\naddress is inside the vmalloc range but in no vm_area, so\ndma_mmap_coherent() -\u003e iommu_dma_mmap() finds no pages, vmalloc_to_pfn()\nreturns page_to_pfn(NULL), and remap_pfn_range() installs a frame above\nMAXPHYADDR.  The first user read then takes:\n\n  psm2_ep_open_pr: Corrupted page table at address 7a14d007e000\n  PGD 800000013886a067 P4D 800000013886a067 PUD 13886b067 PMD 13886c067\n                                            PTE 800049168e911235\n  Oops: Bad pagetable: 000d [#1] SMP PTI\n\nSecond, and still wrong once the arithmetic is corrected,\ndma_mmap_coherent() describes a whole coherent buffer and selects the\npage within it with vma-\u003evm_pgoff.  Offsetting cpu_addr has no effect:\nfor a vmap\u0027d allocation iommu_dma_mmap() uses cpu_addr only to locate the\nvm_area and then maps pages[vm_pgoff], which hfi1_file_mmap() has just\nset to 0.  User space therefore always receives the first credit-return\npage, every credit read is for the wrong context, and send PIO stalls\nforever.\n\nUse the DMA API as intended: pass the base of the allocation with its\nfull length and select the page with vm_pgoff.  A separate length is\nneeded because memlen must keep describing the VMA for the existing size\ncheck.  The dma-direct path stays correct as well, since dma_direct_mmap()\nadds the same vm_pgoff to the base pfn.\n\nTested on a Dell T7610 (Xeon E5-2650 v2, Intel IOMMU in DMA-FQ mode)\nagainst a Threadripper PRO 3995WX peer, both Omni-Path 100.  Before this\nchange psm2_ep_open() Oopses the kernel; with only the arithmetic\ncorrected psm2_ep_open() succeeds but any transfer that uses send PIO\nhangs, PSM2_SDMA=2 (send PIO disabled) completing normally while\nPSM2_SDMA=0 (send PIO only) hangs every time.  With this change send PIO,\nsend DMA and the default mixed mode all work."
          }
        ],
        "id": "CVE-2026-98216",
        "lastModified": "2026-10-07T07:17:04.653",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-06T09:18:08.260",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/180752deb7270ad37394ab6ef7cf4978fad040b3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/535530bb2ea5254e1e9f55280143d262dd065204"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/62f0f34fbd2b2d5653d33d3b9d42fdcabb1c0101"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bafeac9ce5d1ce5256bcf7e5702e831e9aaf419b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dcebe0b0bb080a25fe08011fd6b6e741f7912f01"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-09T11:43:58+00:00",
      "cve": "CVE-2026-98216",
      "id": "CVE-2026-98216",
      "initial_release_date": "2026-10-06T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "45",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: IB/hfi1: Fix the PIO_CRED credit-return mmap",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98216.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-08T16:50:16Z",
      "cve": "CVE-2026-98216",
      "id": "CVE-2026-98216",
      "initial_release_date": "2026-10-08T16:50:16Z",
      "product_status:known_affected": "62",
      "product_status:known_not_affected": "285",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-98216",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-98216.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.