CVE-2026-22980 (GCVE-0-2026-22980)

Vulnerability from cvelistv5 – Published: 2026-01-23 15:24 – Updated: 2026-08-05 12:19
VLAI
Title
nfsd: provide locking for v4_end_grace
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4_end_grace Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl in particularly. We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is held while client_tracking_op->init() is called and that can wait for an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a deadlock. nfsd4_end_grace() is also called by the landromat work queue and this doesn't require locking as server shutdown will stop the work and wait for it before freeing anything that nfsd4_end_grace() might access. However, we must be sure that writing to v4_end_grace doesn't restart the work item after shutdown has already waited for it. For this we add a new flag protected with nn->client_lock. It is set only while it is safe to make client tracking calls, and v4_end_grace only schedules work while the flag is set with the spinlock held. So this patch adds a nfsd_net field "client_tracking_active" which is set as described. Another field "grace_end_forced", is set when v4_end_grace is written. After this is set, and providing client_tracking_active is set, the laundromat is scheduled. This "grace_end_forced" field bypasses other checks for whether the grace period has finished. This resolves a race which can result in use-after-free.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6 , < ca97360860eb02e3ae4ba42c19b439a0fcecbf06 (git)
Affected: 7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6 , < e8bfa2401d4c51eca6e48e9b33c798828ca9df61 (git)
Affected: 7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6 , < 34eb22836e0cdba093baac66599d68c4cd245a9d (git)
Affected: 7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6 , < 06600719d0f7a723811c45e4d51f5b742f345309 (git)
Affected: 7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6 , < ba4811c8b433bfa681729ca42cc62b6034f223b0 (git)
Affected: 7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6 , < 53f07d095e7e680c5e4569a55a019f2c0348cdc6 (git)
Affected: 7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6 , < 2857bd59feb63fcf40fe4baf55401baea6b4feb4 (git)
Create a notification for this product.
Linux Linux Affected: 3.18
Unaffected: 0 , < 3.18 (semver)
Unaffected: 5.10.248 , ≤ 5.10.* (semver)
Unaffected: 5.15.198 , ≤ 5.15.* (semver)
Unaffected: 6.1.161 , ≤ 6.1.* (semver)
Unaffected: 6.6.121 , ≤ 6.6.* (semver)
Unaffected: 6.12.66 , ≤ 6.12.* (semver)
Unaffected: 6.18.6 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22980",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T20:36:55.336499Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T20:37:05.726Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:45:38.283Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/netns.h",
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/nfsctl.c",
            "fs/nfsd/state.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ca97360860eb02e3ae4ba42c19b439a0fcecbf06",
              "status": "affected",
              "version": "7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6",
              "versionType": "git"
            },
            {
              "lessThan": "e8bfa2401d4c51eca6e48e9b33c798828ca9df61",
              "status": "affected",
              "version": "7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6",
              "versionType": "git"
            },
            {
              "lessThan": "34eb22836e0cdba093baac66599d68c4cd245a9d",
              "status": "affected",
              "version": "7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6",
              "versionType": "git"
            },
            {
              "lessThan": "06600719d0f7a723811c45e4d51f5b742f345309",
              "status": "affected",
              "version": "7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6",
              "versionType": "git"
            },
            {
              "lessThan": "ba4811c8b433bfa681729ca42cc62b6034f223b0",
              "status": "affected",
              "version": "7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6",
              "versionType": "git"
            },
            {
              "lessThan": "53f07d095e7e680c5e4569a55a019f2c0348cdc6",
              "status": "affected",
              "version": "7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6",
              "versionType": "git"
            },
            {
              "lessThan": "2857bd59feb63fcf40fe4baf55401baea6b4feb4",
              "status": "affected",
              "version": "7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/netns.h",
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/nfsctl.c",
            "fs/nfsd/state.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "lessThan": "3.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.161",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.121",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.66",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.6",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: provide locking for v4_end_grace\n\nWriting to v4_end_grace can race with server shutdown and result in\nmemory being accessed after it was freed - reclaim_str_hashtbl in\nparticularly.\n\nWe cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is\nheld while client_tracking_op-\u003einit() is called and that can wait for\nan upcall to nfsdcltrack which can write to v4_end_grace, resulting in a\ndeadlock.\n\nnfsd4_end_grace() is also called by the landromat work queue and this\ndoesn\u0027t require locking as server shutdown will stop the work and wait\nfor it before freeing anything that nfsd4_end_grace() might access.\n\nHowever, we must be sure that writing to v4_end_grace doesn\u0027t restart\nthe work item after shutdown has already waited for it.  For this we\nadd a new flag protected with nn-\u003eclient_lock.  It is set only while it\nis safe to make client tracking calls, and v4_end_grace only schedules\nwork while the flag is set with the spinlock held.\n\nSo this patch adds a nfsd_net field \"client_tracking_active\" which is\nset as described.  Another field \"grace_end_forced\", is set when\nv4_end_grace is written.  After this is set, and providing\nclient_tracking_active is set, the laundromat is scheduled.\nThis \"grace_end_forced\" field bypasses other checks for whether the\ngrace period has finished.\n\nThis resolves a race which can result in use-after-free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is a local write to the nfsd control file v4_end_grace, not an NFS network request path. Remote NFS clients cannot directly invoke this administrative procfs transaction.\nAC:L - The race is between two local nfsd control operations, ending grace and shutting down the server, which an attacker with access to the control interface can drive concurrently. No rare memory layout or victim-driven condition is required to trigger the use-after-free.\nPR:L - The vulnerable file is a privileged nfsd management interface, but exploitation requires only local access to an nfsd control/helper context rather than network authentication. When choosing between PR:L and PR:H, the higher-severity defensible value is PR:L.\nUI:N - No victim user action is required once the attacker can issue the local nfsd control operations. The attacker can trigger the race directly.\nS:U - The bug corrupts Linux kernel memory within the same kernel security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The flaw is a use-after-free involving nfsd client-tracking reclaim structures, and UAF conditions can be shaped into kernel memory disclosure primitives. Under the required guidance, UAF maps to high confidentiality impact.\nI:H - The freed reclaim hash/list structures are later walked and modified, giving a plausible path to kernel heap corruption and write/control-flow primitives. Under the required guidance, UAF maps to high integrity impact.\nA:H - At minimum, accessing freed nfsd reclaim data during shutdown can crash or oops the kernel. Kernel UAF-triggered crashes are high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:19:54.700Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ca97360860eb02e3ae4ba42c19b439a0fcecbf06"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8bfa2401d4c51eca6e48e9b33c798828ca9df61"
        },
        {
          "url": "https://git.kernel.org/stable/c/34eb22836e0cdba093baac66599d68c4cd245a9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/06600719d0f7a723811c45e4d51f5b742f345309"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba4811c8b433bfa681729ca42cc62b6034f223b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/53f07d095e7e680c5e4569a55a019f2c0348cdc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/2857bd59feb63fcf40fe4baf55401baea6b4feb4"
        }
      ],
      "title": "nfsd: provide locking for v4_end_grace",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-22980",
    "datePublished": "2026-01-23T15:24:02.924Z",
    "dateReserved": "2026-01-13T15:37:45.936Z",
    "dateUpdated": "2026-08-05T12:19:54.700Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-22980",
      "date": "2026-08-05",
      "epss": "0.0013",
      "percentile": "0.03018"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-03T15:04:31.000Z",
      "cve": "CVE-2026-22980",
      "id": "msrc_CVE-2026-22980",
      "initial_release_date": "2026-01-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "nfsd: provide locking for v4_end_grace",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-22980.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-22980\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-23T16:15:54.003\",\"lastModified\":\"2026-07-14T13:18:21.220\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: provide locking for v4_end_grace\\n\\nWriting to v4_end_grace can race with server shutdown and result in\\nmemory being accessed after it was freed - reclaim_str_hashtbl in\\nparticularly.\\n\\nWe cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is\\nheld while client_tracking_op-\u003einit() is called and that can wait for\\nan upcall to nfsdcltrack which can write to v4_end_grace, resulting in a\\ndeadlock.\\n\\nnfsd4_end_grace() is also called by the landromat work queue and this\\ndoesn\u0027t require locking as server shutdown will stop the work and wait\\nfor it before freeing anything that nfsd4_end_grace() might access.\\n\\nHowever, we must be sure that writing to v4_end_grace doesn\u0027t restart\\nthe work item after shutdown has already waited for it.  For this we\\nadd a new flag protected with nn-\u003eclient_lock.  It is set only while it\\nis safe to make client tracking calls, and v4_end_grace only schedules\\nwork while the flag is set with the spinlock held.\\n\\nSo this patch adds a nfsd_net field \\\"client_tracking_active\\\" which is\\nset as described.  Another field \\\"grace_end_forced\\\", is set when\\nv4_end_grace is written.  After this is set, and providing\\nclient_tracking_active is set, the laundromat is scheduled.\\nThis \\\"grace_end_forced\\\" field bypasses other checks for whether the\\ngrace period has finished.\\n\\nThis resolves a race which can result in use-after-free.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nnfsd: proporcionar bloqueo para v4_end_grace\\n\\nEscribir en v4_end_grace puede competir con el apagado del servidor y resultar en que la memoria sea accedida despu\u00e9s de haber sido liberada - reclaim_str_hashtbl en particular.\\n\\nNo podemos mantener nfsd_mutex durante la llamada a nfsd4_end_grace() ya que se mantiene mientras se llama a client_tracking_op-\u0026gt;init() y eso puede esperar una llamada ascendente a nfsdcltrack que puede escribir en v4_end_grace, resultando en un interbloqueo.\\n\\nnfsd4_end_grace() tambi\u00e9n es llamada por la cola de trabajo \u0027landromat\u0027 y esto no requiere bloqueo ya que el apagado del servidor detendr\u00e1 el trabajo y esperar\u00e1 por \u00e9l antes de liberar cualquier cosa a la que nfsd4_end_grace() pudiera acceder.\\n\\nSin embargo, debemos asegurarnos de que escribir en v4_end_grace no reinicie el elemento de trabajo despu\u00e9s de que el apagado ya lo haya esperado. Para esto a\u00f1adimos una nueva bandera protegida con nn-\u0026gt;client_lock. Se establece solo mientras es seguro realizar llamadas de seguimiento de cliente, y v4_end_grace solo programa trabajo mientras la bandera est\u00e1 establecida con el spinlock mantenido.\\n\\nAs\u00ed, este parche a\u00f1ade un campo nfsd_net \u0027client_tracking_active\u0027 que se establece como se describe. Otro campo \u0027grace_end_forced\u0027, se establece cuando se escribe en v4_end_grace. Despu\u00e9s de que esto se establece, y siempre que client_tracking_active est\u00e9 establecido, el \u0027laundromat\u0027 es programado. Este campo \u0027grace_end_forced\u0027 omite otras comprobaciones para determinar si el per\u00edodo de gracia ha terminado.\\n\\nEsto resuelve una condici\u00f3n de carrera que puede resultar en uso despu\u00e9s de liberaci\u00f3n.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/netns.h\",\"fs/nfsd/nfs4state.c\",\"fs/nfsd/nfsctl.c\",\"fs/nfsd/state.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6\",\"lessThan\":\"ca97360860eb02e3ae4ba42c19b439a0fcecbf06\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6\",\"lessThan\":\"e8bfa2401d4c51eca6e48e9b33c798828ca9df61\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6\",\"lessThan\":\"34eb22836e0cdba093baac66599d68c4cd245a9d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6\",\"lessThan\":\"06600719d0f7a723811c45e4d51f5b742f345309\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6\",\"lessThan\":\"ba4811c8b433bfa681729ca42cc62b6034f223b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6\",\"lessThan\":\"53f07d095e7e680c5e4569a55a019f2c0348cdc6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6\",\"lessThan\":\"2857bd59feb63fcf40fe4baf55401baea6b4feb4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/netns.h\",\"fs/nfsd/nfs4state.c\",\"fs/nfsd/nfsctl.c\",\"fs/nfsd/state.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.248\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.198\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.161\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.121\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.66\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.6\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-16T20:36:55.336499Z\",\"id\":\"CVE-2026-22980\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.18\",\"versionEndExcluding\":\"5.10.248\",\"matchCriteriaId\":\"80713135-E43D-4026-BAD5-679983AB1EC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.198\",\"matchCriteriaId\":\"82159CAA-B6BA-43C6-85D8-65BDBC175A7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.161\",\"matchCriteriaId\":\"E135B7E2-61FC-4DC1-8570-ABD67894FFDE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.121\",\"matchCriteriaId\":\"BB7A164B-7422-4A1C-82FB-5FCAEE53C06C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.66\",\"matchCriteriaId\":\"F72B884C-B44F-40E4-9895-CE421AC663D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.6\",\"matchCriteriaId\":\"879529BC-5B4C-4EBE-BF1D-1A31404A8B2E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06600719d0f7a723811c45e4d51f5b742f345309\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2857bd59feb63fcf40fe4baf55401baea6b4feb4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/34eb22836e0cdba093baac66599d68c4cd245a9d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/53f07d095e7e680c5e4569a55a019f2c0348cdc6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ba4811c8b433bfa681729ca42cc62b6034f223b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ca97360860eb02e3ae4ba42c19b439a0fcecbf06\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e8bfa2401d4c51eca6e48e9b33c798828ca9df61\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-14T14:12:58+00:00",
      "cve": "CVE-2026-22980",
      "id": "CVE-2026-22980",
      "initial_release_date": "2026-01-23T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: provide locking for v4_end_grace",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22980.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-15T05:34:27Z",
      "cve": "CVE-2026-22980",
      "id": "CVE-2026-22980",
      "initial_release_date": "2026-01-27T00:27:06Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "321",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "145",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-22980",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-22980.json",
      "version": "12"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-07-14T12:45:38.283Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-22980\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-16T20:36:55.336499Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-16T20:37:00.900Z\"}}], \"cna\": {\"title\": \"nfsd: provide locking for v4_end_grace\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6\", \"lessThan\": \"ca97360860eb02e3ae4ba42c19b439a0fcecbf06\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6\", \"lessThan\": \"e8bfa2401d4c51eca6e48e9b33c798828ca9df61\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6\", \"lessThan\": \"34eb22836e0cdba093baac66599d68c4cd245a9d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6\", \"lessThan\": \"06600719d0f7a723811c45e4d51f5b742f345309\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6\", \"lessThan\": \"ba4811c8b433bfa681729ca42cc62b6034f223b0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6\", \"lessThan\": \"53f07d095e7e680c5e4569a55a019f2c0348cdc6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6\", \"lessThan\": \"2857bd59feb63fcf40fe4baf55401baea6b4feb4\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/nfsd/netns.h\", \"fs/nfsd/nfs4state.c\", \"fs/nfsd/nfsctl.c\", \"fs/nfsd/state.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.248\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.198\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.161\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.121\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.66\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/nfsd/netns.h\", \"fs/nfsd/nfs4state.c\", \"fs/nfsd/nfsctl.c\", \"fs/nfsd/state.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ca97360860eb02e3ae4ba42c19b439a0fcecbf06\"}, {\"url\": \"https://git.kernel.org/stable/c/e8bfa2401d4c51eca6e48e9b33c798828ca9df61\"}, {\"url\": \"https://git.kernel.org/stable/c/34eb22836e0cdba093baac66599d68c4cd245a9d\"}, {\"url\": \"https://git.kernel.org/stable/c/06600719d0f7a723811c45e4d51f5b742f345309\"}, {\"url\": \"https://git.kernel.org/stable/c/ba4811c8b433bfa681729ca42cc62b6034f223b0\"}, {\"url\": \"https://git.kernel.org/stable/c/53f07d095e7e680c5e4569a55a019f2c0348cdc6\"}, {\"url\": \"https://git.kernel.org/stable/c/2857bd59feb63fcf40fe4baf55401baea6b4feb4\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: provide locking for v4_end_grace\\n\\nWriting to v4_end_grace can race with server shutdown and result in\\nmemory being accessed after it was freed - reclaim_str_hashtbl in\\nparticularly.\\n\\nWe cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is\\nheld while client_tracking_op-\u003einit() is called and that can wait for\\nan upcall to nfsdcltrack which can write to v4_end_grace, resulting in a\\ndeadlock.\\n\\nnfsd4_end_grace() is also called by the landromat work queue and this\\ndoesn\u0027t require locking as server shutdown will stop the work and wait\\nfor it before freeing anything that nfsd4_end_grace() might access.\\n\\nHowever, we must be sure that writing to v4_end_grace doesn\u0027t restart\\nthe work item after shutdown has already waited for it.  For this we\\nadd a new flag protected with nn-\u003eclient_lock.  It is set only while it\\nis safe to make client tracking calls, and v4_end_grace only schedules\\nwork while the flag is set with the spinlock held.\\n\\nSo this patch adds a nfsd_net field \\\"client_tracking_active\\\" which is\\nset as described.  Another field \\\"grace_end_forced\\\", is set when\\nv4_end_grace is written.  After this is set, and providing\\nclient_tracking_active is set, the laundromat is scheduled.\\nThis \\\"grace_end_forced\\\" field bypasses other checks for whether the\\ngrace period has finished.\\n\\nThis resolves a race which can result in use-after-free.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.248\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.198\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.161\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.121\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.66\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.6\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19\", \"versionStartIncluding\": \"3.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T21:57:40.292Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-22980\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-14T12:45:38.283Z\", \"dateReserved\": \"2026-01-13T15:37:45.936Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-01-23T15:24:02.924Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.