GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80931 (GCVE-0-2026-80931)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-14 11:58
VLAI
Title
w1: ds28e17: reject an oversize length on an I2C block read
Summary
In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire to I2C bridge. On an I2C_M_RECV_LEN read, it takes the length from the device. The downstream slave puts a length byte in buf[0]. The driver then reads that many bytes into buf[1] with w1_f19_i2c_read(). buf[0] is controlled by the device and can be 0 to 255. w1_f19_i2c_read() only rejects a zero count. The caller buffer is I2C_SMBUS_BLOCK_MAX + 2, so 34 bytes. A length above 32 makes the read run past it, up to about 222 bytes out of bounds. The SMBus core does check buf[0] against I2C_SMBUS_BLOCK_MAX. That check runs after master_xfer returns. By then the write is already done. i2c-algo-bit rejects an oversize length before it copies, and returns -EPROTO. Reject a length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN sites, the same way i2c-algo-bit does.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ebc4768ac4971eab4b570e733e47ac9dfd0e4175 , < b30c021c6073559ea6851b522d8a17a524a27b4a (git)
Affected: ebc4768ac4971eab4b570e733e47ac9dfd0e4175 , < 1d08877fc37e90945df38d255715bd1d6c052d46 (git)
Affected: ebc4768ac4971eab4b570e733e47ac9dfd0e4175 , < bf76d61e118b7044600a65775a3bf8adc2c6823d (git)
Affected: ebc4768ac4971eab4b570e733e47ac9dfd0e4175 , < 0f6496b34cc2919420f303b2aabdd9f71e084b56 (git)
Affected: ebc4768ac4971eab4b570e733e47ac9dfd0e4175 , < cb55c5da9828f77db2a2701316949d4de1e9b773 (git)
Affected: ebc4768ac4971eab4b570e733e47ac9dfd0e4175 , < ae0c79a8527044e54d81fd5a3b49ce6177633758 (git)
Affected: ebc4768ac4971eab4b570e733e47ac9dfd0e4175 , < 6df05f630c84a109736642362e452089886f9974 (git)
Affected: ebc4768ac4971eab4b570e733e47ac9dfd0e4175 , < 169ae5e65e5aaf213b6a578f6478a9fd2e523606 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/w1/slaves/w1_ds28e17.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b30c021c6073559ea6851b522d8a17a524a27b4a",
              "status": "affected",
              "version": "ebc4768ac4971eab4b570e733e47ac9dfd0e4175",
              "versionType": "git"
            },
            {
              "lessThan": "1d08877fc37e90945df38d255715bd1d6c052d46",
              "status": "affected",
              "version": "ebc4768ac4971eab4b570e733e47ac9dfd0e4175",
              "versionType": "git"
            },
            {
              "lessThan": "bf76d61e118b7044600a65775a3bf8adc2c6823d",
              "status": "affected",
              "version": "ebc4768ac4971eab4b570e733e47ac9dfd0e4175",
              "versionType": "git"
            },
            {
              "lessThan": "0f6496b34cc2919420f303b2aabdd9f71e084b56",
              "status": "affected",
              "version": "ebc4768ac4971eab4b570e733e47ac9dfd0e4175",
              "versionType": "git"
            },
            {
              "lessThan": "cb55c5da9828f77db2a2701316949d4de1e9b773",
              "status": "affected",
              "version": "ebc4768ac4971eab4b570e733e47ac9dfd0e4175",
              "versionType": "git"
            },
            {
              "lessThan": "ae0c79a8527044e54d81fd5a3b49ce6177633758",
              "status": "affected",
              "version": "ebc4768ac4971eab4b570e733e47ac9dfd0e4175",
              "versionType": "git"
            },
            {
              "lessThan": "6df05f630c84a109736642362e452089886f9974",
              "status": "affected",
              "version": "ebc4768ac4971eab4b570e733e47ac9dfd0e4175",
              "versionType": "git"
            },
            {
              "lessThan": "169ae5e65e5aaf213b6a578f6478a9fd2e523606",
              "status": "affected",
              "version": "ebc4768ac4971eab4b570e733e47ac9dfd0e4175",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/w1/slaves/w1_ds28e17.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nw1: ds28e17: reject an oversize length on an I2C block read\n\nw1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire\nto I2C bridge. On an I2C_M_RECV_LEN read, it takes the length from the\ndevice. The downstream slave puts a length byte in buf[0]. The driver\nthen reads that many bytes into buf[1] with w1_f19_i2c_read().\n\nbuf[0] is controlled by the device and can be 0 to 255.\nw1_f19_i2c_read() only rejects a zero count. The caller buffer is\nI2C_SMBUS_BLOCK_MAX + 2, so 34 bytes. A length above 32 makes the read\nrun past it, up to about 222 bytes out of bounds.\n\nThe SMBus core does check buf[0] against I2C_SMBUS_BLOCK_MAX. That\ncheck runs after master_xfer returns. By then the write is already\ndone. i2c-algo-bit rejects an oversize length before it copies, and\nreturns -EPROTO.\n\nReject a length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN sites, the\nsame way i2c-algo-bit does."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is reached from local userspace via /dev/i2c-* I2C_SMBUS or I2C_RDWR ioctls into w1_f19_i2c_master_transfer() on the DS28E17-created I2C adapter; i2c-dev does not require advertised I2C_FUNC_SMBUS_READ_BLOCK_DATA. There is no network path; the 1-Wire-to-I2C bridge being present is a deployment precondition.\nAC:L - A single I2C_M_RECV_LEN block read uses the downstream slave\u0027s first data byte as the extra length with no cap, then w1_f19_i2c_read() copies that many bytes. The attacker chooses the ioctl and target address; a responding slave returning \u003e32 (or data the attacker just wrote) overflows reliably, with no race or uncontrolled layout.\nPR:L - i2cdev_open() has no capability check; reachability depends only on /dev/i2c-* permissions, commonly 0660 root:i2c on embedded and industrial systems. That is unprivileged local access, not real init-namespace root.\nUI:N - The attacker triggers the bug with their own open/ioctl sequence on an already-present DS28E17 I2C adapter node. No victim action such as plugging in a device or mounting a filesystem is required.\nS:U - Impact is ordinary host-kernel stack or heap corruption of the SMBus/i2c-dev transfer buffer within the same kernel authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:H - A device-supplied length up to 255 causes an out-of-bounds write of about 222 bytes past the 34-byte I2C_SMBUS_BLOCK_MAX+2 buffer into adjacent kernel stack or heap. That memory corruption is defensibly leveraged for kernel information disclosure.\nI:H - Slave-controlled bytes are written past the end of the kernel transfer buffer, producing a substantial out-of-bounds kernel write. Such corruption is exploitable for arbitrary memory modification or control-flow hijacking.\nA:H - The out-of-bounds kernel write can corrupt heap or stack state and cause an oops, panic, or hang. The attacker can repeat the local ioctl to deny service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:58:57.943Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b30c021c6073559ea6851b522d8a17a524a27b4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d08877fc37e90945df38d255715bd1d6c052d46"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf76d61e118b7044600a65775a3bf8adc2c6823d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f6496b34cc2919420f303b2aabdd9f71e084b56"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb55c5da9828f77db2a2701316949d4de1e9b773"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae0c79a8527044e54d81fd5a3b49ce6177633758"
        },
        {
          "url": "https://git.kernel.org/stable/c/6df05f630c84a109736642362e452089886f9974"
        },
        {
          "url": "https://git.kernel.org/stable/c/169ae5e65e5aaf213b6a578f6478a9fd2e523606"
        }
      ],
      "title": "w1: ds28e17: reject an oversize length on an I2C block read",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80931",
    "datePublished": "2026-09-11T19:42:06.272Z",
    "dateReserved": "2026-08-26T14:34:25.802Z",
    "dateUpdated": "2026-09-14T11:58:57.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80931",
      "date": "2026-09-18",
      "epss": "0.00129",
      "percentile": "0.02915"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:58:22.000Z",
      "cve": "CVE-2026-80931",
      "id": "msrc_CVE-2026-80931",
      "initial_release_date": "2026-09-13T01:11:02.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "w1: ds28e17: reject an oversize length on an I2C block read",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80931.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/w1/slaves/w1_ds28e17.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b30c021c6073559ea6851b522d8a17a524a27b4a",
                    "status": "affected",
                    "version": "ebc4768ac4971eab4b570e733e47ac9dfd0e4175",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1d08877fc37e90945df38d255715bd1d6c052d46",
                    "status": "affected",
                    "version": "ebc4768ac4971eab4b570e733e47ac9dfd0e4175",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bf76d61e118b7044600a65775a3bf8adc2c6823d",
                    "status": "affected",
                    "version": "ebc4768ac4971eab4b570e733e47ac9dfd0e4175",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0f6496b34cc2919420f303b2aabdd9f71e084b56",
                    "status": "affected",
                    "version": "ebc4768ac4971eab4b570e733e47ac9dfd0e4175",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cb55c5da9828f77db2a2701316949d4de1e9b773",
                    "status": "affected",
                    "version": "ebc4768ac4971eab4b570e733e47ac9dfd0e4175",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ae0c79a8527044e54d81fd5a3b49ce6177633758",
                    "status": "affected",
                    "version": "ebc4768ac4971eab4b570e733e47ac9dfd0e4175",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6df05f630c84a109736642362e452089886f9974",
                    "status": "affected",
                    "version": "ebc4768ac4971eab4b570e733e47ac9dfd0e4175",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "169ae5e65e5aaf213b6a578f6478a9fd2e523606",
                    "status": "affected",
                    "version": "ebc4768ac4971eab4b570e733e47ac9dfd0e4175",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/w1/slaves/w1_ds28e17.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.15"
                  },
                  {
                    "lessThan": "4.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nw1: ds28e17: reject an oversize length on an I2C block read\n\nw1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire\nto I2C bridge. On an I2C_M_RECV_LEN read, it takes the length from the\ndevice. The downstream slave puts a length byte in buf[0]. The driver\nthen reads that many bytes into buf[1] with w1_f19_i2c_read().\n\nbuf[0] is controlled by the device and can be 0 to 255.\nw1_f19_i2c_read() only rejects a zero count. The caller buffer is\nI2C_SMBUS_BLOCK_MAX + 2, so 34 bytes. A length above 32 makes the read\nrun past it, up to about 222 bytes out of bounds.\n\nThe SMBus core does check buf[0] against I2C_SMBUS_BLOCK_MAX. That\ncheck runs after master_xfer returns. By then the write is already\ndone. i2c-algo-bit rejects an oversize length before it copies, and\nreturns -EPROTO.\n\nReject a length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN sites, the\nsame way i2c-algo-bit does."
          }
        ],
        "id": "CVE-2026-80931",
        "lastModified": "2026-09-14T13:18:49.327",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:18:56.893",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0f6496b34cc2919420f303b2aabdd9f71e084b56"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/169ae5e65e5aaf213b6a578f6478a9fd2e523606"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1d08877fc37e90945df38d255715bd1d6c052d46"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6df05f630c84a109736642362e452089886f9974"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ae0c79a8527044e54d81fd5a3b49ce6177633758"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b30c021c6073559ea6851b522d8a17a524a27b4a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bf76d61e118b7044600a65775a3bf8adc2c6823d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cb55c5da9828f77db2a2701316949d4de1e9b773"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T14:48:08+00:00",
      "cve": "CVE-2026-80931",
      "id": "CVE-2026-80931",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: w1: ds28e17: reject an oversize length on an I2C block read",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80931.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:06:13Z",
      "cve": "CVE-2026-80931",
      "id": "CVE-2026-80931",
      "initial_release_date": "2026-09-15T01:06:13Z",
      "product_status:known_affected": "176",
      "product_status:known_not_affected": "177",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80931",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80931.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.