CVE-2025-40096 (GCVE-0-2025-40096)
Vulnerability from cvelistv5
Published
2025-10-30 09:48
Modified
2026-08-05 12:07
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies When adding dependencies with drm_sched_job_add_dependency(), that function consumes the fence reference both on success and failure, so in the latter case the dma_fence_put() on the error path (xarray failed to expand) is a double free. Interestingly this bug appears to have been present ever since commit ebd5f74255b9 ("drm/sched: Add dependency tracking"), since the code back then looked like this: drm_sched_job_add_implicit_dependencies(): ... for (i = 0; i < fence_count; i++) { ret = drm_sched_job_add_dependency(job, fences[i]); if (ret) break; } for (; i < fence_count; i++) dma_fence_put(fences[i]); Which means for the failing 'i' the dma_fence_put was already a double free. Possibly there were no users at that time, or the test cases were insufficient to hit it. The bug was then only noticed and fixed after commit 9c2ba265352a ("drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2") landed, with its fixup of commit 4eaf02d6076c ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies"). At that point it was a slightly different flavour of a double free, which commit 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder") noticed and attempted to fix. But it only moved the double free from happening inside the drm_sched_job_add_dependency(), when releasing the reference not yet obtained, to the caller, when releasing the reference already released by the former in the failure case. As such it is not easy to identify the right target for the fixes tag so lets keep it simple and just continue the chain. While fixing we also improve the comment and explain the reason for taking the reference and not dropping it.
Impacted products
Vendor Product Version
Linux Linux Version: 963d0b3569354230f6e2c36a286ef270a8901878
Version: 963d0b3569354230f6e2c36a286ef270a8901878
Version: 963d0b3569354230f6e2c36a286ef270a8901878
Version: 963d0b3569354230f6e2c36a286ef270a8901878
Version: 963d0b3569354230f6e2c36a286ef270a8901878
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40096",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T19:41:41.321644Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T19:41:52.101Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/scheduler/sched_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4c38a63ae12ecc9370a7678077bde2d61aa80e9c",
              "status": "affected",
              "version": "963d0b3569354230f6e2c36a286ef270a8901878",
              "versionType": "git"
            },
            {
              "lessThan": "57239762aa90ad768dac055021f27705dae73344",
              "status": "affected",
              "version": "963d0b3569354230f6e2c36a286ef270a8901878",
              "versionType": "git"
            },
            {
              "lessThan": "e5e3eb2aff92994ee81ce633f1c4e73bd4b87e11",
              "status": "affected",
              "version": "963d0b3569354230f6e2c36a286ef270a8901878",
              "versionType": "git"
            },
            {
              "lessThan": "fdfb47e85af1e11ec822c82739dde2dd8dff5115",
              "status": "affected",
              "version": "963d0b3569354230f6e2c36a286ef270a8901878",
              "versionType": "git"
            },
            {
              "lessThan": "5801e65206b065b0b2af032f7f1eef222aa2fd83",
              "status": "affected",
              "version": "963d0b3569354230f6e2c36a286ef270a8901878",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/scheduler/sched_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.158",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.114",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.55",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.5",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies\n\nWhen adding dependencies with drm_sched_job_add_dependency(), that\nfunction consumes the fence reference both on success and failure, so in\nthe latter case the dma_fence_put() on the error path (xarray failed to\nexpand) is a double free.\n\nInterestingly this bug appears to have been present ever since\ncommit ebd5f74255b9 (\"drm/sched: Add dependency tracking\"), since the code\nback then looked like this:\n\ndrm_sched_job_add_implicit_dependencies():\n...\n       for (i = 0; i \u003c fence_count; i++) {\n               ret = drm_sched_job_add_dependency(job, fences[i]);\n               if (ret)\n                       break;\n       }\n\n       for (; i \u003c fence_count; i++)\n               dma_fence_put(fences[i]);\n\nWhich means for the failing \u0027i\u0027 the dma_fence_put was already a double\nfree. Possibly there were no users at that time, or the test cases were\ninsufficient to hit it.\n\nThe bug was then only noticed and fixed after\ncommit 9c2ba265352a (\"drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2\")\nlanded, with its fixup of\ncommit 4eaf02d6076c (\"drm/scheduler: fix drm_sched_job_add_implicit_dependencies\").\n\nAt that point it was a slightly different flavour of a double free, which\ncommit 963d0b356935 (\"drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder\")\nnoticed and attempted to fix.\n\nBut it only moved the double free from happening inside the\ndrm_sched_job_add_dependency(), when releasing the reference not yet\nobtained, to the caller, when releasing the reference already released by\nthe former in the failure case.\n\nAs such it is not easy to identify the right target for the fixes tag so\nlets keep it simple and just continue the chain.\n\nWhile fixing we also improve the comment and explain the reason for taking\nthe reference and not dropping it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through GPU job-submission ioctls (MSM_GEM_SUBMIT, PANFROST_SUBMIT, AMDGPU_CS, xe/v3d/lima/etnaviv/pvr equivalents) on a local DRM render node. There is no network or remote-peer path into drm_sched_job_add_resv_dependencies().\nAC:L - The double put fires on the xa_alloc() -ENOMEM path, which the attacker can steer by sustaining memory pressure and by submitting jobs with many BOs/fences to force many xarray node allocations. Failed attempts merely return -ENOMEM to userspace, so the ioctl can be retried in a tight loop until the allocation fails, making the trigger attacker-influenced and repeatable rather than a condition outside their control.\nPR:L - All calling ioctls are marked DRM_RENDER_ALLOW with no capability check, so an ordinary unprivileged process holding an fd on /dev/dri/renderD128 suffices \u2014 every Android app, every Chrome OS sandboxed GPU client, and any desktop user in the render/video group. No root or CAP_SYS_ADMIN is needed.\nUI:N - The attacker submits its own GPU jobs against its own buffer objects; no victim action, mount, or file open is required. Exploitation is fully self-contained in the attacking process.\nS:U - The corruption stays within the kernel\u0027s own memory and security authority \u2014 a standard local kernel memory-safety issue with no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The extra dma_fence_put() frees a fence still referenced by the BO\u0027s dma_resv, the scheduler, and other jobs\u0027 dependency arrays, giving a use-after-free on a slab object (drm_sched_fence has its own kmem_cache). Reclaiming that memory with attacker-controlled data allows disclosure of kernel memory contents via the stale fence dereferences.\nI:H - The freed dma_fence is subsequently dereferenced through its ops table (-\u003esignaled, -\u003ewait, -\u003erelease) and its dma_fence_cb callback list, both of which are function pointers in the freed allocation. Heap grooming of the reclaimed object therefore yields a write/control-flow-hijack primitive, i.e. potential privilege escalation.\nA:H - Even without successful grooming, the refcount underflow and premature free cause use-after-free dereferences in the GPU scheduler, producing an oops/panic or GPU-wide hang. Any kernel crash is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:47.604Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4c38a63ae12ecc9370a7678077bde2d61aa80e9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/57239762aa90ad768dac055021f27705dae73344"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5e3eb2aff92994ee81ce633f1c4e73bd4b87e11"
        },
        {
          "url": "https://git.kernel.org/stable/c/fdfb47e85af1e11ec822c82739dde2dd8dff5115"
        },
        {
          "url": "https://git.kernel.org/stable/c/5801e65206b065b0b2af032f7f1eef222aa2fd83"
        }
      ],
      "title": "drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40096",
    "datePublished": "2025-10-30T09:48:03.954Z",
    "dateReserved": "2025-04-16T07:20:57.163Z",
    "dateUpdated": "2026-08-05T12:07:47.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-40096\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-16T19:41:41.321644Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-16T19:41:46.937Z\"}}], \"cna\": {\"title\": \"drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached only through GPU job-submission ioctls (MSM_GEM_SUBMIT, PANFROST_SUBMIT, AMDGPU_CS, xe/v3d/lima/etnaviv/pvr equivalents) on a local DRM render node. There is no network or remote-peer path into drm_sched_job_add_resv_dependencies().\\nAC:L - The double put fires on the xa_alloc() -ENOMEM path, which the attacker can steer by sustaining memory pressure and by submitting jobs with many BOs/fences to force many xarray node allocations. Failed attempts merely return -ENOMEM to userspace, so the ioctl can be retried in a tight loop until the allocation fails, making the trigger attacker-influenced and repeatable rather than a condition outside their control.\\nPR:L - All calling ioctls are marked DRM_RENDER_ALLOW with no capability check, so an ordinary unprivileged process holding an fd on /dev/dri/renderD128 suffices \\u2014 every Android app, every Chrome OS sandboxed GPU client, and any desktop user in the render/video group. No root or CAP_SYS_ADMIN is needed.\\nUI:N - The attacker submits its own GPU jobs against its own buffer objects; no victim action, mount, or file open is required. Exploitation is fully self-contained in the attacking process.\\nS:U - The corruption stays within the kernel\u0027s own memory and security authority \\u2014 a standard local kernel memory-safety issue with no VM, IOMMU, or hypervisor boundary crossed.\\nC:H - The extra dma_fence_put() frees a fence still referenced by the BO\u0027s dma_resv, the scheduler, and other jobs\u0027 dependency arrays, giving a use-after-free on a slab object (drm_sched_fence has its own kmem_cache). Reclaiming that memory with attacker-controlled data allows disclosure of kernel memory contents via the stale fence dereferences.\\nI:H - The freed dma_fence is subsequently dereferenced through its ops table (-\u003esignaled, -\u003ewait, -\u003erelease) and its dma_fence_cb callback list, both of which are function pointers in the freed allocation. Heap grooming of the reclaimed object therefore yields a write/control-flow-hijack primitive, i.e. potential privilege escalation.\\nA:H - Even without successful grooming, the refcount underflow and premature free cause use-after-free dereferences in the GPU scheduler, producing an oops/panic or GPU-wide hang. Any kernel crash is High availability impact.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"963d0b3569354230f6e2c36a286ef270a8901878\", \"lessThan\": \"4c38a63ae12ecc9370a7678077bde2d61aa80e9c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"963d0b3569354230f6e2c36a286ef270a8901878\", \"lessThan\": \"57239762aa90ad768dac055021f27705dae73344\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"963d0b3569354230f6e2c36a286ef270a8901878\", \"lessThan\": \"e5e3eb2aff92994ee81ce633f1c4e73bd4b87e11\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"963d0b3569354230f6e2c36a286ef270a8901878\", \"lessThan\": \"fdfb47e85af1e11ec822c82739dde2dd8dff5115\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"963d0b3569354230f6e2c36a286ef270a8901878\", \"lessThan\": \"5801e65206b065b0b2af032f7f1eef222aa2fd83\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/scheduler/sched_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.158\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.114\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.17.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/scheduler/sched_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4c38a63ae12ecc9370a7678077bde2d61aa80e9c\"}, {\"url\": \"https://git.kernel.org/stable/c/57239762aa90ad768dac055021f27705dae73344\"}, {\"url\": \"https://git.kernel.org/stable/c/e5e3eb2aff92994ee81ce633f1c4e73bd4b87e11\"}, {\"url\": \"https://git.kernel.org/stable/c/fdfb47e85af1e11ec822c82739dde2dd8dff5115\"}, {\"url\": \"https://git.kernel.org/stable/c/5801e65206b065b0b2af032f7f1eef222aa2fd83\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies\\n\\nWhen adding dependencies with drm_sched_job_add_dependency(), that\\nfunction consumes the fence reference both on success and failure, so in\\nthe latter case the dma_fence_put() on the error path (xarray failed to\\nexpand) is a double free.\\n\\nInterestingly this bug appears to have been present ever since\\ncommit ebd5f74255b9 (\\\"drm/sched: Add dependency tracking\\\"), since the code\\nback then looked like this:\\n\\ndrm_sched_job_add_implicit_dependencies():\\n...\\n       for (i = 0; i \u003c fence_count; i++) {\\n               ret = drm_sched_job_add_dependency(job, fences[i]);\\n               if (ret)\\n                       break;\\n       }\\n\\n       for (; i \u003c fence_count; i++)\\n               dma_fence_put(fences[i]);\\n\\nWhich means for the failing \u0027i\u0027 the dma_fence_put was already a double\\nfree. Possibly there were no users at that time, or the test cases were\\ninsufficient to hit it.\\n\\nThe bug was then only noticed and fixed after\\ncommit 9c2ba265352a (\\\"drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2\\\")\\nlanded, with its fixup of\\ncommit 4eaf02d6076c (\\\"drm/scheduler: fix drm_sched_job_add_implicit_dependencies\\\").\\n\\nAt that point it was a slightly different flavour of a double free, which\\ncommit 963d0b356935 (\\\"drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder\\\")\\nnoticed and attempted to fix.\\n\\nBut it only moved the double free from happening inside the\\ndrm_sched_job_add_dependency(), when releasing the reference not yet\\nobtained, to the caller, when releasing the reference already released by\\nthe former in the failure case.\\n\\nAs such it is not easy to identify the right target for the fixes tag so\\nlets keep it simple and just continue the chain.\\n\\nWhile fixing we also improve the comment and explain the reason for taking\\nthe reference and not dropping it.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.158\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.114\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.55\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17.5\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18\", \"versionStartIncluding\": \"5.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:07:47.604Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-40096\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T12:07:47.604Z\", \"dateReserved\": \"2025-04-16T07:20:57.163Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-10-30T09:48:03.954Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…