CVE-2026-72183 (GCVE-0-2026-72183)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-17 05:41
VLAI
Title
landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path
Summary
In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path LANDLOCK_SCOPE_SIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path. A sandboxed process that owns any file or socket can arm it with fcntl(fd, F_SETOWN, -pgid), fcntl(fd, F_SETSIG, SIGKILL) and O_ASYNC, so that an I/O event makes the kernel deliver the chosen signal to the whole process group. As the head of its process group's task list (the default position right after fork()) that group can also hold the non-sandboxed process that launched it, e.g. a supervisor or a security monitor. The sandbox can thus kill or signal the processes LANDLOCK_SCOPE_SIGNAL is meant to protect from it. The scope is enforced in hook_file_send_sigiotask() against the Landlock domain recorded at F_SETOWN time, not the live domain of the sender. control_current_fowner() decides whether to record that domain and skips recording it when the fowner target is in the caller's thread group, which is safe only for a single-task target (PIDTYPE_PID, PIDTYPE_TGID). For a process group (PIDTYPE_PGID) pid_task() returns only one member; recording is skipped whenever that member shares the caller's thread group, and hook_file_send_sigiotask() then lets the signal fan out to the whole group unchecked. Record the domain for every non single-process target so the scope is enforced against each group member at delivery time. That recording is necessary but not sufficient on its own: the kernel signals a process group through its members' thread-group leaders, and the leader of the registrant's own process can carry a different Landlock domain than the sibling thread that armed the owner. domain_is_scoped() would then deny that leader, even though commit 18eb75f3af40 ("landlock: Always allow signals between threads of the same process") requires same-process delivery to be allowed. hook_task_kill() avoids this by evaluating same_thread_group() live, per recipient; the SIGIO path instead delegates the whole decision to a single registration-time check, which a process-group fan-out cannot honor. So also record the registrant's thread group next to its domain and exempt it at delivery: hook_file_send_sigiotask() allows the signal whenever the recipient belongs to the registrant's own process, restoring the same-process guarantee while keeping out-of-domain group members blocked. The direct kill() path (hook_task_kill) already evaluates the live domain and is unaffected. [mic: Check pid_type earlier and improve comment, fix commit message, fix comment formatting]
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 332facfa80751b80006c2f95b13c6d208ab0aee1 , < 7a92e9fd1d496a610b40e0c4253fd54e7496f5ab (git)
Affected: 18eb75f3af40be1f0fc2025d4ff821711222a2fd , < 1f18aac2637220b5847d073447498e81ddca10b2 (git)
Affected: 18eb75f3af40be1f0fc2025d4ff821711222a2fd , < 04916f7dc6d37cd478b06c86398c34a6963ac8c9 (git)
Affected: 18eb75f3af40be1f0fc2025d4ff821711222a2fd , < 4b80320ca7ed03d6e683f95b6066565dc97b9f92 (git)
Affected: 6861348d863c0eaa4af67492d640a9644a829c59 (git)
Affected: 0906a9685d7057aea982e970da3e1cf3e5aca68b (git)
Affected: 6.12.24 , < 6.12.101 (semver)
Affected: 6.13.12 , < 6.14 (semver)
Affected: 6.14.3 , < 6.15 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/landlock/fs.c",
            "security/landlock/fs.h",
            "security/landlock/task.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7a92e9fd1d496a610b40e0c4253fd54e7496f5ab",
              "status": "affected",
              "version": "332facfa80751b80006c2f95b13c6d208ab0aee1",
              "versionType": "git"
            },
            {
              "lessThan": "1f18aac2637220b5847d073447498e81ddca10b2",
              "status": "affected",
              "version": "18eb75f3af40be1f0fc2025d4ff821711222a2fd",
              "versionType": "git"
            },
            {
              "lessThan": "04916f7dc6d37cd478b06c86398c34a6963ac8c9",
              "status": "affected",
              "version": "18eb75f3af40be1f0fc2025d4ff821711222a2fd",
              "versionType": "git"
            },
            {
              "lessThan": "4b80320ca7ed03d6e683f95b6066565dc97b9f92",
              "status": "affected",
              "version": "18eb75f3af40be1f0fc2025d4ff821711222a2fd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6861348d863c0eaa4af67492d640a9644a829c59",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0906a9685d7057aea982e970da3e1cf3e5aca68b",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.101",
              "status": "affected",
              "version": "6.12.24",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14",
              "status": "affected",
              "version": "6.13.12",
              "versionType": "semver"
            },
            {
              "lessThan": "6.15",
              "status": "affected",
              "version": "6.14.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/landlock/fs.c",
            "security/landlock/fs.h",
            "security/landlock/task.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.12.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.14.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path\n\nLANDLOCK_SCOPE_SIGNAL must prevent a sandboxed process from signaling\nprocesses outside its Landlock domain.  It can be bypassed through the\nasynchronous SIGIO delivery path.\n\nA sandboxed process that owns any file or socket can arm it with\nfcntl(fd, F_SETOWN, -pgid), fcntl(fd, F_SETSIG, SIGKILL) and O_ASYNC, so\nthat an I/O event makes the kernel deliver the chosen signal to the\nwhole process group.  As the head of its process group\u0027s task list (the\ndefault position right after fork()) that group can also hold the\nnon-sandboxed process that launched it, e.g. a supervisor or a security\nmonitor.  The sandbox can thus kill or signal the processes\nLANDLOCK_SCOPE_SIGNAL is meant to protect from it.\n\nThe scope is enforced in hook_file_send_sigiotask() against the Landlock\ndomain recorded at F_SETOWN time, not the live domain of the sender.\ncontrol_current_fowner() decides whether to record that domain and skips\nrecording it when the fowner target is in the caller\u0027s thread group,\nwhich is safe only for a single-task target (PIDTYPE_PID, PIDTYPE_TGID).\nFor a process group (PIDTYPE_PGID) pid_task() returns only one member;\nrecording is skipped whenever that member shares the caller\u0027s thread\ngroup, and hook_file_send_sigiotask() then lets the signal fan out to\nthe whole group unchecked.\n\nRecord the domain for every non single-process target so the scope is\nenforced against each group member at delivery time.\n\nThat recording is necessary but not sufficient on its own: the kernel\nsignals a process group through its members\u0027 thread-group leaders, and\nthe leader of the registrant\u0027s own process can carry a different\nLandlock domain than the sibling thread that armed the owner.\ndomain_is_scoped() would then deny that leader, even though commit\n18eb75f3af40 (\"landlock: Always allow signals between threads of the\nsame process\") requires same-process delivery to be allowed.\nhook_task_kill() avoids this by evaluating same_thread_group() live, per\nrecipient; the SIGIO path instead delegates the whole decision to a\nsingle registration-time check, which a process-group fan-out cannot\nhonor.\n\nSo also record the registrant\u0027s thread group next to its domain and\nexempt it at delivery: hook_file_send_sigiotask() allows the signal\nwhenever the recipient belongs to the registrant\u0027s own process,\nrestoring the same-process guarantee while keeping out-of-domain group\nmembers blocked.  The direct kill() path (hook_task_kill) already\nevaluates the live domain and is unaffected.\n\n[mic: Check pid_type earlier and improve comment, fix commit message,\nfix comment formatting]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls (fcntl F_SETOWN/F_SETSIG/F_SETFL, landlock_restrict_self, and pipe or socket I/O); the bug is in hook_file_send_sigiotask() on the SIGIO path with no network, Bluetooth, or physical entry point.\nAC:L - The attacker controls every step (fork into the launcher process group, apply LANDLOCK_SCOPE_SIGNAL, arm O_ASYNC with -pgid, trigger I/O); the upstream selftest reproduces the bypass deterministically with no race or layout dependency.\nPR:L - Only an ordinary local user running inside a Landlock sandbox with LANDLOCK_SCOPE_SIGNAL is needed; landlock_restrict_self() and fcntl() require no capabilities (selftests call drop_caps()), matching other Landlock CVE scoring.\nUI:N - The exploited supervisor or monitor is the attacker\u0027s own parent in the shared process group; escalation is driven entirely by the sandboxed process\u0027s syscalls with no separate victim interaction.\nS:C - This bypasses LANDLOCK_SCOPE_SIGNAL, letting a confined process signal or SIGKILL tasks outside its Landlock domain (e.g., the unsandboxed launcher), crossing the sandbox security authority like CVE-2024-42318.\nC:N - The flaw only skips signal-scope enforcement on asynchronous SIGIO delivery; it does not read kernel or victim memory or leak pointers, and no confidentiality primitive is created even with arbitrary signal choice.\nI:H - A sandboxed attacker can deliver arbitrary signals including SIGKILL to every out-of-domain process group member reachable via fcntl(F_SETOWN,-pgid)/O_ASYNC, completely defeating the integrity of LANDLOCK_SCOPE_SIGNAL protections.\nA:H - SIGKILL (explicitly shown in the fix commit) or other fatal/control signals terminate the supervisor, security monitor, or peer processes the policy was meant to isolate, causing high availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:13.731Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7a92e9fd1d496a610b40e0c4253fd54e7496f5ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f18aac2637220b5847d073447498e81ddca10b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/04916f7dc6d37cd478b06c86398c34a6963ac8c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b80320ca7ed03d6e683f95b6066565dc97b9f92"
        }
      ],
      "title": "landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72183",
    "datePublished": "2026-08-15T05:53:45.922Z",
    "dateReserved": "2026-08-09T03:40:39.910Z",
    "dateUpdated": "2026-08-17T05:41:13.731Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72183",
      "date": "2026-08-24",
      "epss": "0.0017",
      "percentile": "0.06398"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72183\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:21:36.640\",\"lastModified\":\"2026-08-17T06:18:18.850\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlandlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path\\n\\nLANDLOCK_SCOPE_SIGNAL must prevent a sandboxed process from signaling\\nprocesses outside its Landlock domain.  It can be bypassed through the\\nasynchronous SIGIO delivery path.\\n\\nA sandboxed process that owns any file or socket can arm it with\\nfcntl(fd, F_SETOWN, -pgid), fcntl(fd, F_SETSIG, SIGKILL) and O_ASYNC, so\\nthat an I/O event makes the kernel deliver the chosen signal to the\\nwhole process group.  As the head of its process group\u0027s task list (the\\ndefault position right after fork()) that group can also hold the\\nnon-sandboxed process that launched it, e.g. a supervisor or a security\\nmonitor.  The sandbox can thus kill or signal the processes\\nLANDLOCK_SCOPE_SIGNAL is meant to protect from it.\\n\\nThe scope is enforced in hook_file_send_sigiotask() against the Landlock\\ndomain recorded at F_SETOWN time, not the live domain of the sender.\\ncontrol_current_fowner() decides whether to record that domain and skips\\nrecording it when the fowner target is in the caller\u0027s thread group,\\nwhich is safe only for a single-task target (PIDTYPE_PID, PIDTYPE_TGID).\\nFor a process group (PIDTYPE_PGID) pid_task() returns only one member;\\nrecording is skipped whenever that member shares the caller\u0027s thread\\ngroup, and hook_file_send_sigiotask() then lets the signal fan out to\\nthe whole group unchecked.\\n\\nRecord the domain for every non single-process target so the scope is\\nenforced against each group member at delivery time.\\n\\nThat recording is necessary but not sufficient on its own: the kernel\\nsignals a process group through its members\u0027 thread-group leaders, and\\nthe leader of the registrant\u0027s own process can carry a different\\nLandlock domain than the sibling thread that armed the owner.\\ndomain_is_scoped() would then deny that leader, even though commit\\n18eb75f3af40 (\\\"landlock: Always allow signals between threads of the\\nsame process\\\") requires same-process delivery to be allowed.\\nhook_task_kill() avoids this by evaluating same_thread_group() live, per\\nrecipient; the SIGIO path instead delegates the whole decision to a\\nsingle registration-time check, which a process-group fan-out cannot\\nhonor.\\n\\nSo also record the registrant\u0027s thread group next to its domain and\\nexempt it at delivery: hook_file_send_sigiotask() allows the signal\\nwhenever the recipient belongs to the registrant\u0027s own process,\\nrestoring the same-process guarantee while keeping out-of-domain group\\nmembers blocked.  The direct kill() path (hook_task_kill) already\\nevaluates the live domain and is unaffected.\\n\\n[mic: Check pid_type earlier and improve comment, fix commit message,\\nfix comment formatting]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"security/landlock/fs.c\",\"security/landlock/fs.h\",\"security/landlock/task.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"332facfa80751b80006c2f95b13c6d208ab0aee1\",\"lessThan\":\"7a92e9fd1d496a610b40e0c4253fd54e7496f5ab\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"18eb75f3af40be1f0fc2025d4ff821711222a2fd\",\"lessThan\":\"1f18aac2637220b5847d073447498e81ddca10b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"18eb75f3af40be1f0fc2025d4ff821711222a2fd\",\"lessThan\":\"04916f7dc6d37cd478b06c86398c34a6963ac8c9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"18eb75f3af40be1f0fc2025d4ff821711222a2fd\",\"lessThan\":\"4b80320ca7ed03d6e683f95b6066565dc97b9f92\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6861348d863c0eaa4af67492d640a9644a829c59\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0906a9685d7057aea982e970da3e1cf3e5aca68b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.12.24\",\"lessThan\":\"6.12.101\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.13.12\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.14.3\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"security/landlock/fs.c\",\"security/landlock/fs.h\",\"security/landlock/task.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":5.8}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04916f7dc6d37cd478b06c86398c34a6963ac8c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1f18aac2637220b5847d073447498e81ddca10b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4b80320ca7ed03d6e683f95b6066565dc97b9f92\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7a92e9fd1d496a610b40e0c4253fd54e7496f5ab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T07:06:13+00:00",
      "cve": "CVE-2026-72183",
      "id": "CVE-2026-72183",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72183.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.