CVE-2026-98282 (GCVE-0-2026-98282)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:45 – Updated: 2026-10-07 06:49
VLAI
Title
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
Summary
In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified IOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba(). While doing so, the passed in argument npages is ignored and constant value '1' is used leaving out a possible overflow as the callers can legitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT cases. Fix this by accounting for 'npages', checking for arithmetic overflow, and verifying that the entire requested range (ioba - offset + npages) does not exceed the table capacity 'size'.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 54/100 over 6619 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b1af23d836f811137d504d14d4cbdd01929dec34 , < 98d8dcc4ebd10523507d4478e148809a7771a213 (git)
Affected: b1af23d836f811137d504d14d4cbdd01929dec34 , < 9fd9c9bbb05417f468a11fb6d145d7ff61f4a868 (git)
Affected: b1af23d836f811137d504d14d4cbdd01929dec34 , < 3776bf56e06980e8a12c8c0565d9e6ac44965f03 (git)
Affected: b1af23d836f811137d504d14d4cbdd01929dec34 , < d6a1779129d936bc1fbab80181165da544eab736 (git)
Affected: b1af23d836f811137d504d14d4cbdd01929dec34 , < d48ceb6e1a6915c7bac4f902554a1047365cdff2 (git)
Affected: b1af23d836f811137d504d14d4cbdd01929dec34 , < 0543813753ef5cfbd6fa96694f7acf783fa01af7 (git)
Affected: b1af23d836f811137d504d14d4cbdd01929dec34 , < 314091243159f8e3749bc719bb129f423f72fd86 (git)
Affected: b1af23d836f811137d504d14d4cbdd01929dec34 , < 0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 5.10.271 , ≤ 5.10.* (semver)
Unaffected: 5.15.222 , ≤ 5.15.* (semver)
Unaffected: 6.1.189 , ≤ 6.1.* (semver)
Unaffected: 6.6.158 , ≤ 6.6.* (semver)
Unaffected: 6.12.112 , ≤ 6.12.* (semver)
Unaffected: 6.18.54 , ≤ 6.18.* (semver)
Unaffected: 7.2.8 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/kernel/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "98d8dcc4ebd10523507d4478e148809a7771a213",
              "status": "affected",
              "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
              "versionType": "git"
            },
            {
              "lessThan": "9fd9c9bbb05417f468a11fb6d145d7ff61f4a868",
              "status": "affected",
              "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
              "versionType": "git"
            },
            {
              "lessThan": "3776bf56e06980e8a12c8c0565d9e6ac44965f03",
              "status": "affected",
              "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
              "versionType": "git"
            },
            {
              "lessThan": "d6a1779129d936bc1fbab80181165da544eab736",
              "status": "affected",
              "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
              "versionType": "git"
            },
            {
              "lessThan": "d48ceb6e1a6915c7bac4f902554a1047365cdff2",
              "status": "affected",
              "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
              "versionType": "git"
            },
            {
              "lessThan": "0543813753ef5cfbd6fa96694f7acf783fa01af7",
              "status": "affected",
              "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
              "versionType": "git"
            },
            {
              "lessThan": "314091243159f8e3749bc719bb129f423f72fd86",
              "status": "affected",
              "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
              "versionType": "git"
            },
            {
              "lessThan": "0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71",
              "status": "affected",
              "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/kernel/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba\n\nThe commit b1af23d836f8 (\"KVM: PPC: iommu: Unify TCE checking\") unified\nIOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba().\nWhile doing so, the passed in argument npages is ignored and constant\nvalue \u00271\u0027 is used leaving out a possible overflow as the callers can\nlegitimately be using npages \u003e 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT\ncases.\n\nFix this by accounting for \u0027npages\u0027, checking for arithmetic overflow,\nand verifying that the entire requested range (ioba - offset + npages)\ndoes not exceed the table capacity \u0027size\u0027."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bad ioba/npages values come from a KVM guest\u0027s H_STUFF_TCE or H_PUT_TCE_INDIRECT hypercall registers. book3s_hv.c passes them to kvmppc_h_stuff_tce()/kvmppc_h_put_tce_indirect(), which call kvmppc_ioba_validate() -\u003e iommu_tce_check_ioba(). The attacker is code running on the host in a guest, not a remote network peer.\nAC:L - The guest picks liobn, ioba (the last valid entry) and npages itself. The flawed check only tests ioba+1, so every such hypercall reliably walks kvmppc_tce_put() past stt-\u003esize. No race or outside condition is involved; only heap grooming affects how far exploitation goes.\nPR:L - The attacker needs kernel privilege inside their own guest, which any tenant of a pseries KVM VM has. Relative to the host, that is a low-privilege tenant position. The guest\u0027s TCE table already exists because QEMU creates it through KVM_CREATE_SPAPR_TCE_64 for the default PHB/VIO DMA windows.\nUI:N - The guest issues the hypercalls whenever it wants. No action by the host administrator or any other user is needed.\nS:C - A guest-controlled hypercall corrupts host kernel memory and touches the host\u0027s hardware IOMMU table outside the guest\u0027s DMA window. The impact therefore crosses the guest-to-host virtualization boundary.\nC:H - kvmppc_tce_put() and kvmppc_h_get_tce paths index stt-\u003epages[] past the kmalloc\u0027d flexible array, and the TCE iommu_unmap/map paths use entries beyond the window. This gives out-of-bounds access to host heap and IOMMU state that can be turned into host memory disclosure.\nI:H - In H_STUFF_TCE, npages is unbounded and tce_value is guest-chosen. kvmppc_tce_put() writes that 8-byte value through an out-of-bounds stt-\u003epages[] pointer, or stores a newly allocated page pointer into the out-of-bounds slot. Both are host heap writes.\nA:H - Dereferencing an out-of-bounds stt-\u003epages[] entry as a struct page, or corrupting the host heap and IOMMU tables, crashes or oopses the host. That takes down every VM running on it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T06:49:53.499Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/98d8dcc4ebd10523507d4478e148809a7771a213"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fd9c9bbb05417f468a11fb6d145d7ff61f4a868"
        },
        {
          "url": "https://git.kernel.org/stable/c/3776bf56e06980e8a12c8c0565d9e6ac44965f03"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6a1779129d936bc1fbab80181165da544eab736"
        },
        {
          "url": "https://git.kernel.org/stable/c/d48ceb6e1a6915c7bac4f902554a1047365cdff2"
        },
        {
          "url": "https://git.kernel.org/stable/c/0543813753ef5cfbd6fa96694f7acf783fa01af7"
        },
        {
          "url": "https://git.kernel.org/stable/c/314091243159f8e3749bc719bb129f423f72fd86"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71"
        }
      ],
      "title": "powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98282",
    "datePublished": "2026-10-06T08:45:43.775Z",
    "dateReserved": "2026-09-25T10:25:14.335Z",
    "dateUpdated": "2026-10-07T06:49:53.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98282",
      "date": "2026-10-11",
      "epss": "0.00138",
      "percentile": "0.02797"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/powerpc/kernel/iommu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "98d8dcc4ebd10523507d4478e148809a7771a213",
                    "status": "affected",
                    "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9fd9c9bbb05417f468a11fb6d145d7ff61f4a868",
                    "status": "affected",
                    "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3776bf56e06980e8a12c8c0565d9e6ac44965f03",
                    "status": "affected",
                    "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d6a1779129d936bc1fbab80181165da544eab736",
                    "status": "affected",
                    "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d48ceb6e1a6915c7bac4f902554a1047365cdff2",
                    "status": "affected",
                    "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0543813753ef5cfbd6fa96694f7acf783fa01af7",
                    "status": "affected",
                    "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "314091243159f8e3749bc719bb129f423f72fd86",
                    "status": "affected",
                    "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71",
                    "status": "affected",
                    "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/powerpc/kernel/iommu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.12"
                  },
                  {
                    "lessThan": "4.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.271",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.222",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.189",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.158",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba\n\nThe commit b1af23d836f8 (\"KVM: PPC: iommu: Unify TCE checking\") unified\nIOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba().\nWhile doing so, the passed in argument npages is ignored and constant\nvalue \u00271\u0027 is used leaving out a possible overflow as the callers can\nlegitimately be using npages \u003e 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT\ncases.\n\nFix this by accounting for \u0027npages\u0027, checking for arithmetic overflow,\nand verifying that the entire requested range (ioba - offset + npages)\ndoes not exceed the table capacity \u0027size\u0027."
          }
        ],
        "id": "CVE-2026-98282",
        "lastModified": "2026-10-07T07:17:07.920",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-06T09:18:18.180",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0543813753ef5cfbd6fa96694f7acf783fa01af7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/314091243159f8e3749bc719bb129f423f72fd86"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3776bf56e06980e8a12c8c0565d9e6ac44965f03"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/98d8dcc4ebd10523507d4478e148809a7771a213"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9fd9c9bbb05417f468a11fb6d145d7ff61f4a868"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d48ceb6e1a6915c7bac4f902554a1047365cdff2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d6a1779129d936bc1fbab80181165da544eab736"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-10T22:20:20+00:00",
      "cve": "CVE-2026-98282",
      "id": "CVE-2026-98282",
      "initial_release_date": "2026-10-06T00:00:00+00:00",
      "product_status:known_affected": "249",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98282.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-09T16:53:21Z",
      "cve": "CVE-2026-98282",
      "id": "CVE-2026-98282",
      "initial_release_date": "2026-10-07T00:00:49Z",
      "product_status:known_affected": "341",
      "product_status:known_not_affected": "2",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-98282",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-98282.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.