GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80947 (GCVE-0-2026-80947)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-13 06:28
VLAI
Title
wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop rtl8xxxu arms rx_urb_wq from the RX completion path: rtl8xxxu_rx_complete() hands the URB to rtl8xxxu_queue_rx_urb(), which queues it on rx_urb_pending_list and, once the list grows past RTL8XXXU_RX_URB_PENDING_WATER, schedules rx_urb_wq. The worker rtl8xxxu_rx_urb_work() drains rx_urb_pending_list, recovers priv through container_of, and resubmits each URB through rtl8xxxu_submit_rx_urb(), which anchors it on rx_anchor and dereferences priv->udev. rtl8xxxu_stop() cancels the sibling work items (c2hcmd_work, ra_watchdog, update_beacon_work) but never cancels rx_urb_wq, so a worker armed during the last burst of RX traffic can run rtl8xxxu_rx_urb_work() after rtl8xxxu_disconnect() has called ieee80211_free_hw(), which frees priv, producing a use-after-free. The window opens under active RX traffic (pending count above the watermark) followed by a disconnect. There are two teardown races to close: * rtl8xxxu_queue_rx_urb() decided whether to enqueue under rx_urb_lock but called schedule_work() after dropping the lock. A completion that observed shutdown == false and released the lock could then call schedule_work() after rtl8xxxu_stop() had set shutdown and cancel_work_sync() had already returned, arming the worker to run after the teardown. Move schedule_work() under the same !shutdown branch so the arming decision is atomic with the shutdown check. * rtl8xxxu_rx_urb_work() anchors every URB it drained back onto rx_anchor through rtl8xxxu_submit_rx_urb(). A worker still running when usb_kill_anchored_urbs(&priv->rx_anchor) returned would submit a URB that escaped the kill. In rtl8xxxu_stop(), call cancel_work_sync(&priv->rx_urb_wq) before the kill so the worker is drained first. After priv->shutdown is set under rx_urb_lock, completions can no longer queue rx_urb_wq. cancel_work_sync() then drains the last queued or running worker, and the following usb_kill_anchored_urbs() kills the URBs it may have submitted. rtl8xxxu_disconnect() is covered because ieee80211_unregister_hw() guarantees .stop() runs for a live interface before ieee80211_free_hw() frees priv. The probe error path needs no cancel: rx_urb_wq is INIT_WORK()'d there but cannot have been scheduled, since no URB is submitted before ieee80211_register_hw() succeeds. This bug was found by static analysis.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa , < 800d2b490a9af1e7132a3564c2ad5a81292e5b40 (git)
Affected: 26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa , < 620acb1e8037b73a457dc8ef20fc23fc7adcb405 (git)
Affected: 26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa , < 972ab8b9c08f3eb3fa535082de2950dd93604dfd (git)
Affected: 26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa , < 6c080026ecc17eecb103f8927c64ea73a74bb818 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.4
Unaffected: 0 , < 4.4 (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtl8xxxu/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "800d2b490a9af1e7132a3564c2ad5a81292e5b40",
              "status": "affected",
              "version": "26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa",
              "versionType": "git"
            },
            {
              "lessThan": "620acb1e8037b73a457dc8ef20fc23fc7adcb405",
              "status": "affected",
              "version": "26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa",
              "versionType": "git"
            },
            {
              "lessThan": "972ab8b9c08f3eb3fa535082de2950dd93604dfd",
              "status": "affected",
              "version": "26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa",
              "versionType": "git"
            },
            {
              "lessThan": "6c080026ecc17eecb103f8927c64ea73a74bb818",
              "status": "affected",
              "version": "26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtl8xxxu/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop\n\nrtl8xxxu arms rx_urb_wq from the RX completion path:\nrtl8xxxu_rx_complete() hands the URB to rtl8xxxu_queue_rx_urb(), which\nqueues it on rx_urb_pending_list and, once the list grows past\nRTL8XXXU_RX_URB_PENDING_WATER, schedules rx_urb_wq.  The worker\nrtl8xxxu_rx_urb_work() drains rx_urb_pending_list, recovers priv through\ncontainer_of, and resubmits each URB through rtl8xxxu_submit_rx_urb(),\nwhich anchors it on rx_anchor and dereferences priv-\u003eudev.\n\nrtl8xxxu_stop() cancels the sibling work items (c2hcmd_work, ra_watchdog,\nupdate_beacon_work) but never cancels rx_urb_wq, so a worker armed during\nthe last burst of RX traffic can run rtl8xxxu_rx_urb_work() after\nrtl8xxxu_disconnect() has called ieee80211_free_hw(), which frees priv,\nproducing a use-after-free.  The window opens under active RX traffic\n(pending count above the watermark) followed by a disconnect.\n\nThere are two teardown races to close:\n\n  * rtl8xxxu_queue_rx_urb() decided whether to enqueue under rx_urb_lock\n    but called schedule_work() after dropping the lock.  A completion\n    that observed shutdown == false and released the lock could then call\n    schedule_work() after rtl8xxxu_stop() had set shutdown and\n    cancel_work_sync() had already returned, arming the worker to run\n    after the teardown.  Move schedule_work() under the same !shutdown\n    branch so the arming decision is atomic with the shutdown check.\n\n  * rtl8xxxu_rx_urb_work() anchors every URB it drained back onto\n    rx_anchor through rtl8xxxu_submit_rx_urb().  A worker still running\n    when usb_kill_anchored_urbs(\u0026priv-\u003erx_anchor) returned would submit a\n    URB that escaped the kill.  In rtl8xxxu_stop(), call\n    cancel_work_sync(\u0026priv-\u003erx_urb_wq) before the kill so the worker is\n    drained first.\n\nAfter priv-\u003eshutdown is set under rx_urb_lock, completions can no longer\nqueue rx_urb_wq. cancel_work_sync() then drains the last queued or running\nworker, and the following usb_kill_anchored_urbs() kills the URBs it may\nhave submitted.\n\nrtl8xxxu_disconnect() is covered because ieee80211_unregister_hw()\nguarantees .stop() runs for a live interface before ieee80211_free_hw()\nfrees priv.  The probe error path needs no cancel: rx_urb_wq is\nINIT_WORK()\u0027d there but cannot have been scheduled, since no URB is\nsubmitted before ieee80211_register_hw() succeeds.\n\nThis bug was found by static analysis."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached when rtl8xxxu_stop()/rtl8xxxu_disconnect() runs while rx_urb_wq is armed. An adjacent Wi-Fi peer can complete RX URBs and queue the work, but cannot invoke stop or ieee80211_free_hw(); teardown is a local action (interface down, rfkill, suspend, USB unbind or unplug).\nAC:L - The attacker controls both sides of the race: they generate RX traffic so rx_urb_pending_count exceeds RTL8XXXU_RX_URB_PENDING_WATER (8) and schedule_work(\u0026rx_urb_wq) fires, then they trigger stop/disconnect while the worker is queued or still resubmitting URBs, retrying until the window after ieee80211_free_hw() is hit.\nPR:L - An ordinary local user can trigger teardown via logind-mediated suspend, rfkill, or USB unplug on a shared workstation, and needs no capability to generate the RX traffic that queues rx_urb_wq. CAP_NET_ADMIN to bring the interface down is also available via user namespaces when the wiphy is delegated into that netns.\nUI:N - The attacker generates the RX burst and performs the interface stop or USB disconnect themselves; no separate victim must open a file, mount a filesystem, or otherwise interact.\nS:U - The use-after-free corrupts the rtl8xxxu_priv kernel object and USB URB state inside the host kernel; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - rtl8xxxu_rx_urb_work() recovers the freed priv via container_of and reads priv-\u003eudev, priv-\u003efops, and pending-list/rx_anchor state. A sprayed replacement slab object therefore yields an arbitrary kernel read primitive.\nI:H - The worker list_splice_init()s the freed pending list, usb_anchor_urb()s onto priv-\u003erx_anchor, and the workqueue core mutates the embedded work_struct inside the freed priv, giving heap-write and control-flow hijack primitives.\nA:H - Executing rtl8xxxu_rx_urb_work() against freed priv oopses or panics on the spinlock, list, or udev dereference, and the attacker can retrigger it on every device stop or USB disconnect."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:28:22.546Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/800d2b490a9af1e7132a3564c2ad5a81292e5b40"
        },
        {
          "url": "https://git.kernel.org/stable/c/620acb1e8037b73a457dc8ef20fc23fc7adcb405"
        },
        {
          "url": "https://git.kernel.org/stable/c/972ab8b9c08f3eb3fa535082de2950dd93604dfd"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c080026ecc17eecb103f8927c64ea73a74bb818"
        }
      ],
      "title": "wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80947",
    "datePublished": "2026-09-11T19:42:18.282Z",
    "dateReserved": "2026-08-26T14:34:25.803Z",
    "dateUpdated": "2026-09-13T06:28:22.546Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80947",
      "date": "2026-09-16",
      "epss": "0.00159",
      "percentile": "0.05428"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:59:00.000Z",
      "cve": "CVE-2026-80947",
      "id": "msrc_CVE-2026-80947",
      "initial_release_date": "2026-09-13T01:11:34.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80947.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80947\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:00.303\",\"lastModified\":\"2026-09-13T07:17:01.960\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop\\n\\nrtl8xxxu arms rx_urb_wq from the RX completion path:\\nrtl8xxxu_rx_complete() hands the URB to rtl8xxxu_queue_rx_urb(), which\\nqueues it on rx_urb_pending_list and, once the list grows past\\nRTL8XXXU_RX_URB_PENDING_WATER, schedules rx_urb_wq.  The worker\\nrtl8xxxu_rx_urb_work() drains rx_urb_pending_list, recovers priv through\\ncontainer_of, and resubmits each URB through rtl8xxxu_submit_rx_urb(),\\nwhich anchors it on rx_anchor and dereferences priv-\u003eudev.\\n\\nrtl8xxxu_stop() cancels the sibling work items (c2hcmd_work, ra_watchdog,\\nupdate_beacon_work) but never cancels rx_urb_wq, so a worker armed during\\nthe last burst of RX traffic can run rtl8xxxu_rx_urb_work() after\\nrtl8xxxu_disconnect() has called ieee80211_free_hw(), which frees priv,\\nproducing a use-after-free.  The window opens under active RX traffic\\n(pending count above the watermark) followed by a disconnect.\\n\\nThere are two teardown races to close:\\n\\n  * rtl8xxxu_queue_rx_urb() decided whether to enqueue under rx_urb_lock\\n    but called schedule_work() after dropping the lock.  A completion\\n    that observed shutdown == false and released the lock could then call\\n    schedule_work() after rtl8xxxu_stop() had set shutdown and\\n    cancel_work_sync() had already returned, arming the worker to run\\n    after the teardown.  Move schedule_work() under the same !shutdown\\n    branch so the arming decision is atomic with the shutdown check.\\n\\n  * rtl8xxxu_rx_urb_work() anchors every URB it drained back onto\\n    rx_anchor through rtl8xxxu_submit_rx_urb().  A worker still running\\n    when usb_kill_anchored_urbs(\u0026priv-\u003erx_anchor) returned would submit a\\n    URB that escaped the kill.  In rtl8xxxu_stop(), call\\n    cancel_work_sync(\u0026priv-\u003erx_urb_wq) before the kill so the worker is\\n    drained first.\\n\\nAfter priv-\u003eshutdown is set under rx_urb_lock, completions can no longer\\nqueue rx_urb_wq. cancel_work_sync() then drains the last queued or running\\nworker, and the following usb_kill_anchored_urbs() kills the URBs it may\\nhave submitted.\\n\\nrtl8xxxu_disconnect() is covered because ieee80211_unregister_hw()\\nguarantees .stop() runs for a live interface before ieee80211_free_hw()\\nfrees priv.  The probe error path needs no cancel: rx_urb_wq is\\nINIT_WORK()\u0027d there but cannot have been scheduled, since no URB is\\nsubmitted before ieee80211_register_hw() succeeds.\\n\\nThis bug was found by static analysis.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/realtek/rtl8xxxu/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa\",\"lessThan\":\"800d2b490a9af1e7132a3564c2ad5a81292e5b40\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa\",\"lessThan\":\"620acb1e8037b73a457dc8ef20fc23fc7adcb405\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa\",\"lessThan\":\"972ab8b9c08f3eb3fa535082de2950dd93604dfd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"26f1fad29ad973b0fb26a9ca3dcb2a73dde781aa\",\"lessThan\":\"6c080026ecc17eecb103f8927c64ea73a74bb818\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/realtek/rtl8xxxu/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/620acb1e8037b73a457dc8ef20fc23fc7adcb405\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6c080026ecc17eecb103f8927c64ea73a74bb818\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/800d2b490a9af1e7132a3564c2ad5a81292e5b40\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/972ab8b9c08f3eb3fa535082de2950dd93604dfd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T16:46:30+00:00",
      "cve": "CVE-2026-80947",
      "id": "CVE-2026-80947",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "185",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80947.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:05:45Z",
      "cve": "CVE-2026-80947",
      "id": "CVE-2026-80947",
      "initial_release_date": "2026-09-12T16:37:08Z",
      "product_status:known_affected": "320",
      "product_status:known_not_affected": "33",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80947",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80947.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.