CVE-2026-81000 (GCVE-0-2026-81000)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-14 11:59
VLAI
Title
net: tun: bound receive headroom
Summary
In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows and the result becomes negative when stored in good_linear. That value later wraps when assigned to the size_t linear variable, and tun_alloc_skb() can place skb->data outside the allocated head. Bound the headroom stored by TUN to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset. Leave one linear byte for raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN. Also pull the raw-TUN protocol byte and the TAP Ethernet header before accessing them, so these checks remain safe for nonlinear skbs supplied by other allocation paths.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: eaea34b23c46bf17b4a5638be69ab3561854f34b , < ad715e713610d2d5473c3a6498c825ccecf26491 (git)
Affected: eaea34b23c46bf17b4a5638be69ab3561854f34b , < 708e87937de93f445225c134a2e20519f9b4ce60 (git)
Affected: eaea34b23c46bf17b4a5638be69ab3561854f34b , < 18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76 (git)
Affected: eaea34b23c46bf17b4a5638be69ab3561854f34b , < 010eee265d6bd8769b6a523d2a0693d9b3f5df43 (git)
Affected: eaea34b23c46bf17b4a5638be69ab3561854f34b , < 379d85c7f25f3e05a428225e6b8a65613c6e9b9d (git)
Affected: eaea34b23c46bf17b4a5638be69ab3561854f34b , < e098d9cc8859614a7f7baebc96e32a5a16b18ed2 (git)
Affected: eaea34b23c46bf17b4a5638be69ab3561854f34b , < 0ada54ea63e48b9c1608e917ccb7dfadbe86db28 (git)
Affected: eaea34b23c46bf17b4a5638be69ab3561854f34b , < 447c9303942c439a117d9b76ce6d6e2116b38ee7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.6
Unaffected: 0 , < 4.6 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad715e713610d2d5473c3a6498c825ccecf26491",
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "versionType": "git"
            },
            {
              "lessThan": "708e87937de93f445225c134a2e20519f9b4ce60",
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "versionType": "git"
            },
            {
              "lessThan": "18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76",
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "versionType": "git"
            },
            {
              "lessThan": "010eee265d6bd8769b6a523d2a0693d9b3f5df43",
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "versionType": "git"
            },
            {
              "lessThan": "379d85c7f25f3e05a428225e6b8a65613c6e9b9d",
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "versionType": "git"
            },
            {
              "lessThan": "e098d9cc8859614a7f7baebc96e32a5a16b18ed2",
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "versionType": "git"
            },
            {
              "lessThan": "0ada54ea63e48b9c1608e917ccb7dfadbe86db28",
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "versionType": "git"
            },
            {
              "lessThan": "447c9303942c439a117d9b76ce6d6e2116b38ee7",
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: bound receive headroom\n\ntun_get_user() uses tun-\u003ealign both as skb headroom and when choosing how\nmuch packet data to keep linear. OVS can propagate an oversized headroom\nrequest from another port to TUN or TAP.\n\nWhen align is larger than the usable space in a one-page skb head,\nSKB_MAX_HEAD(align) underflows and the result becomes negative when stored\nin good_linear. That value later wraps when assigned to the size_t linear\nvariable, and tun_alloc_skb() can place skb-\u003edata outside the allocated\nhead.\n\nBound the headroom stored by TUN to the one-page skb-head budget and the\nlargest non-sentinel 16-bit skb header offset. Leave one linear byte for\nraw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.\n\nAlso pull the raw-TUN protocol byte and the TAP Ethernet header before\naccessing them, so these checks remain safe for nonlinear skbs supplied by\nother allocation paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - tun_get_user() runs on write/sendmsg to /dev/net/tun after ndo_set_rx_headroom stores an oversized tun-\u003ealign. That is a local tun/tap injection path, not parsing of frames received from a remote peer.\nAC:L - The attacker fully controls both sides: inflate rx headroom via netkit IFLA_NETKIT_HEADROOM or the OVS/veth/VXLAN and bridge/veth/GRETAP loops, then write a TUN frame. No race or uninfluenced victim state is required.\nPR:L - TUNSETIFF uses ns_capable(net-\u003euser_ns, CAP_NET_ADMIN) and OVS vport commands use GENL_UNS_ADMIN_PERM, so an unprivileged user with a user+net namespace can create the topology and trigger the write.\nUI:N - The attacker opens /dev/net/tun, configures local net devices, and writes the frame; no separate victim action is required.\nS:U - The out-of-bounds access occurs in the same kernel that handles the local TUN write and yields privilege escalation within that kernel, not a VM/IOMMU boundary crossing.\nC:H - SKB_MAX_HEAD underflow wraps the linear length so tun_alloc_skb()/skb_reserve() can place skb-\u003edata outside the allocated head, turning later header reads and packet processing into out-of-bounds kernel reads.\nI:H - After skb-\u003edata is moved outside the allocated head, skb_copy_datagram_from_iter copies attacker-controlled frame bytes relative to that pointer, an out-of-bounds write usable for kernel corruption and control-flow hijacking.\nA:H - The misplaced skb leads to a kernel oops, BUG() in eth_type_trans/__skb_pull on a nonlinear TAP skb, or panic when the out-of-bounds access is hit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:59:35.300Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad715e713610d2d5473c3a6498c825ccecf26491"
        },
        {
          "url": "https://git.kernel.org/stable/c/708e87937de93f445225c134a2e20519f9b4ce60"
        },
        {
          "url": "https://git.kernel.org/stable/c/18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76"
        },
        {
          "url": "https://git.kernel.org/stable/c/010eee265d6bd8769b6a523d2a0693d9b3f5df43"
        },
        {
          "url": "https://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28"
        },
        {
          "url": "https://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7"
        }
      ],
      "title": "net: tun: bound receive headroom",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-81000",
    "datePublished": "2026-09-11T19:42:54.181Z",
    "dateReserved": "2026-08-26T14:34:25.812Z",
    "dateUpdated": "2026-09-14T11:59:35.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-81000",
      "date": "2026-10-02",
      "epss": "0.00357",
      "percentile": "0.27129"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/tun.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ad715e713610d2d5473c3a6498c825ccecf26491",
                    "status": "affected",
                    "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "708e87937de93f445225c134a2e20519f9b4ce60",
                    "status": "affected",
                    "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76",
                    "status": "affected",
                    "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "010eee265d6bd8769b6a523d2a0693d9b3f5df43",
                    "status": "affected",
                    "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "379d85c7f25f3e05a428225e6b8a65613c6e9b9d",
                    "status": "affected",
                    "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e098d9cc8859614a7f7baebc96e32a5a16b18ed2",
                    "status": "affected",
                    "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0ada54ea63e48b9c1608e917ccb7dfadbe86db28",
                    "status": "affected",
                    "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "447c9303942c439a117d9b76ce6d6e2116b38ee7",
                    "status": "affected",
                    "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/tun.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.6"
                  },
                  {
                    "lessThan": "4.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: bound receive headroom\n\ntun_get_user() uses tun-\u003ealign both as skb headroom and when choosing how\nmuch packet data to keep linear. OVS can propagate an oversized headroom\nrequest from another port to TUN or TAP.\n\nWhen align is larger than the usable space in a one-page skb head,\nSKB_MAX_HEAD(align) underflows and the result becomes negative when stored\nin good_linear. That value later wraps when assigned to the size_t linear\nvariable, and tun_alloc_skb() can place skb-\u003edata outside the allocated\nhead.\n\nBound the headroom stored by TUN to the one-page skb-head budget and the\nlargest non-sentinel 16-bit skb header offset. Leave one linear byte for\nraw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.\n\nAlso pull the raw-TUN protocol byte and the TAP Ethernet header before\naccessing them, so these checks remain safe for nonlinear skbs supplied by\nother allocation paths."
          }
        ],
        "id": "CVE-2026-81000",
        "lastModified": "2026-09-14T13:18:54.210",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:07.710",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/010eee265d6bd8769b6a523d2a0693d9b3f5df43"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/708e87937de93f445225c134a2e20519f9b4ce60"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ad715e713610d2d5473c3a6498c825ccecf26491"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-30T14:45:55+00:00",
      "cve": "CVE-2026-81000",
      "id": "CVE-2026-81000",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:fixed": "2280",
      "product_status:known_affected": "24",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: tun: bound receive headroom",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81000.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-02T16:48:33Z",
      "cve": "CVE-2026-81000",
      "id": "CVE-2026-81000",
      "initial_release_date": "2026-09-15T01:04:19Z",
      "product_status:known_affected": "347",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "78",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-81000",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-81000.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.