GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74730 (GCVE-0-2026-74730)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:42
VLAI
Title
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
Summary
In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct nfs_server' object for the duration of the FREE_STATEID so it doesn't get cleaned up from underneath us while operations are still in flight.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < ed2f92ce2fc48463c41e0e540b9a3454889e8af8 (git)
Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < d858ab09e787106432d4d9830bad9dfedf02f890 (git)
Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < af62f1af182d33a0de38308c012841885d8ab92e (git)
Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd (git)
Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < ed1161ab6239761958b38d5667225634fc2be894 (git)
Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < d71dfffa512e71b166a889484e4c3b148a9a3af2 (git)
Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < 80ed3d762628b36c9e4b22fac7c65b72ef3b13dd (git)
Affected: 7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009 , < cf616096a0f3a2b60f7d68b6b39674a6867ded9c (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.10
Unaffected: 0 , < 3.10 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ed2f92ce2fc48463c41e0e540b9a3454889e8af8",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "d858ab09e787106432d4d9830bad9dfedf02f890",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "af62f1af182d33a0de38308c012841885d8ab92e",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "ed1161ab6239761958b38d5667225634fc2be894",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "d71dfffa512e71b166a889484e4c3b148a9a3af2",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "80ed3d762628b36c9e4b22fac7c65b72ef3b13dd",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            },
            {
              "lessThan": "cf616096a0f3a2b60f7d68b6b39674a6867ded9c",
              "status": "affected",
              "version": "7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call\n\nDan Aloni reports that he was able to hit a use-after-free bug if a\nFREE_STATEID operation gets delayed for whatever reason. Fix this by\nbumping the refcount of the \u0027struct nfs_server\u0027 object for the duration\nof the FREE_STATEID so it doesn\u0027t get cleaned up from underneath us\nwhile operations are still in flight."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the NFSv4 client FREE_STATEID path: nfs41_free_stateid_prepare/done/release use a freed struct nfs_server while handling async RPC completions driven by NFSv4 replies from the mounted server and by server-initiated CB_RECALL/CB_RECALLANY callbacks on the NFS backchannel.\nAC:L - The attacker controls both sides of the race: they provoke FREE_STATEID via revocation responses or callbacks, keep it in flight with NFS4ERR_DELAY, and time nfs_server teardown via user-mount umount, automount idle expiry, or the concurrent stateid cleanup that runs during umount itself.\nPR:N - A malicious or compromised NFSv4 server needs no account or elevated capability on the victim client once an NFSv4.1+ mount exists; FREE_STATEID is issued automatically during server-driven stateid revocation handling without any client-side privileges at exploit time.\nUI:N - After an NFS mount exists (boot-time, autofs, or Kubernetes volumes are common), no further victim action is needed: the attacker drives recall/revocation on the wire and mount teardown follows from automated autofs expiry or attacker-controlled umount on a user-mounted export.\nS:U - The use-after-free corrupts kernel heap within the NFS client on the same host; it is a standard kernel memory-safety bug, not a VM escape, container breakout, or IOMMU/DMA boundary crossing.\nC:H - Freed struct nfs_server objects are kmalloc\u0027d and callbacks dereference nfs_client, rpc_clnt, and super_block fields after nfs_free_server/call_rcu, giving a classic UAF read primitive over attacker-influenced heap contents including function pointers.\nI:H - UAF on struct nfs_server exposes destroy hooks, RPC client handles, and client/session state pointers that an attacker can reschedule via heap grooming, yielding write and control-flow primitives typical of NFS client heap corruption bugs.\nA:H - Use of a freed nfs_server in RPC prepare/done/release paths causes kernel oops or panic; Dan Aloni demonstrated reliable reproduction, and UAFs in this path crash hosts even when not fully weaponized."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:42:09.527Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890"
        },
        {
          "url": "https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e"
        },
        {
          "url": "https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894"
        },
        {
          "url": "https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2"
        },
        {
          "url": "https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c"
        }
      ],
      "title": "NFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74730",
    "datePublished": "2026-08-22T15:33:19.659Z",
    "dateReserved": "2026-08-15T05:44:03.930Z",
    "dateUpdated": "2026-08-25T05:42:09.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74730",
      "date": "2026-09-16",
      "epss": "0.0051",
      "percentile": "0.42265"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:52:12.000Z",
      "cve": "CVE-2026-74730",
      "id": "msrc_CVE-2026-74730",
      "initial_release_date": "2026-08-24T01:09:56.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "NFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74730.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74730\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:48.137\",\"lastModified\":\"2026-08-25T06:18:59.463\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nNFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call\\n\\nDan Aloni reports that he was able to hit a use-after-free bug if a\\nFREE_STATEID operation gets delayed for whatever reason. Fix this by\\nbumping the refcount of the \u0027struct nfs_server\u0027 object for the duration\\nof the FREE_STATEID so it doesn\u0027t get cleaned up from underneath us\\nwhile operations are still in flight.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfs/nfs4proc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\"lessThan\":\"ed2f92ce2fc48463c41e0e540b9a3454889e8af8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\"lessThan\":\"d858ab09e787106432d4d9830bad9dfedf02f890\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\"lessThan\":\"af62f1af182d33a0de38308c012841885d8ab92e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\"lessThan\":\"caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\"lessThan\":\"ed1161ab6239761958b38d5667225634fc2be894\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\"lessThan\":\"d71dfffa512e71b166a889484e4c3b148a9a3af2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\"lessThan\":\"80ed3d762628b36c9e4b22fac7c65b72ef3b13dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009\",\"lessThan\":\"cf616096a0f3a2b60f7d68b6b39674a6867ded9c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfs/nfs4proc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:56:34+00:00",
      "cve": "CVE-2026-74730",
      "id": "CVE-2026-74730",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: NFS: Pin the \u0027struct nfs_server\u0027 during a FREE_STATEID call",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74730.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:15:36Z",
      "cve": "CVE-2026-74730",
      "id": "CVE-2026-74730",
      "initial_release_date": "2026-08-26T01:11:36Z",
      "product_status:known_affected": "353",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74730",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74730.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.