CVE-2026-89654 (GCVE-0-2026-89654)
Vulnerability from cvelistv5
Published
2026-09-11 19:45
Modified
2026-10-30 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix UAF in check_new_map() on session freed during unlock
check_new_map() iterates mdsc->sessions[] and for each active session
drops mdsc->mutex to perform per-session operations. The forced-close
path (rank removed from map) correctly takes a reference on s via
ceph_get_mds_session() before releasing mdsc->mutex, but three other
paths do not:
Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex)
Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s)
Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex)
Without the extra reference, another thread can acquire mdsc->mutex
during the unlock window, call __unregister_session() which drops the
last reference on s, and free it. The original thread then accesses
freed memory via s->s_mutex.
Fix by adding ceph_get_mds_session(s) before each mutex_unlock and
ceph_put_mds_session(s) after the corresponding mutex_lock, matching
the pattern already used in the forced-close path.
Race timeline (Path A):
Thread A (check_new_map) Thread B (another map update
holds mdsc->mutex or session teardown)
-------------------------- --------------------------
s = mdsc->sessions[i]
(refcount == 1, held only by
sessions[] array)
mutex_unlock(&mdsc->mutex)
---> acquires mdsc->mutex
__unregister_session(mdsc, s)
sessions[i] = NULL
ceph_put_mds_session(s)
refcount: 1 -> 0
kfree(s) <--- freed!
mutex_lock(&s->s_mutex)
UAF on freed s->s_mutex
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2f2dc053404febedc9c273452d9d518fb31fde72 Version: 2f2dc053404febedc9c273452d9d518fb31fde72 Version: 2f2dc053404febedc9c273452d9d518fb31fde72 Version: 2f2dc053404febedc9c273452d9d518fb31fde72 Version: 2f2dc053404febedc9c273452d9d518fb31fde72 Version: 2f2dc053404febedc9c273452d9d518fb31fde72 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89654",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:25:25.205939Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:47.126Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ceph/mds_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "989343b7ee5b1a08778be0c7c4bf6030d3910807",
"status": "affected",
"version": "2f2dc053404febedc9c273452d9d518fb31fde72",
"versionType": "git"
},
{
"lessThan": "352a278d5a1965aae3f817ce5d24a67ee42d45d1",
"status": "affected",
"version": "2f2dc053404febedc9c273452d9d518fb31fde72",
"versionType": "git"
},
{
"lessThan": "820871e9dbeecd2533c4c5f5d91878ceaf02324c",
"status": "affected",
"version": "2f2dc053404febedc9c273452d9d518fb31fde72",
"versionType": "git"
},
{
"lessThan": "9646dfee880730aae4b379a4b8ee6c88ac735acd",
"status": "affected",
"version": "2f2dc053404febedc9c273452d9d518fb31fde72",
"versionType": "git"
},
{
"lessThan": "21d5be092d947f8d83f76f7ebf3989e7e9230a98",
"status": "affected",
"version": "2f2dc053404febedc9c273452d9d518fb31fde72",
"versionType": "git"
},
{
"lessThan": "ee611a7509554c4ca1f54f6aefe592fb1df7ea70",
"status": "affected",
"version": "2f2dc053404febedc9c273452d9d518fb31fde72",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ceph/mds_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix UAF in check_new_map() on session freed during unlock\n\ncheck_new_map() iterates mdsc-\u003esessions[] and for each active session\ndrops mdsc-\u003emutex to perform per-session operations. The forced-close\npath (rank removed from map) correctly takes a reference on s via\nceph_get_mds_session() before releasing mdsc-\u003emutex, but three other\npaths do not:\n\n Path A (address changed): mutex_unlock \u2192 mutex_lock(\u0026s-\u003es_mutex)\n Path B (reconnect): mutex_unlock \u2192 send_mds_reconnect(mdsc, s)\n Path C (active transition): mutex_unlock \u2192 mutex_lock(\u0026s-\u003es_mutex)\n\nWithout the extra reference, another thread can acquire mdsc-\u003emutex\nduring the unlock window, call __unregister_session() which drops the\nlast reference on s, and free it. The original thread then accesses\nfreed memory via s-\u003es_mutex.\n\nFix by adding ceph_get_mds_session(s) before each mutex_unlock and\nceph_put_mds_session(s) after the corresponding mutex_lock, matching\nthe pattern already used in the forced-close path.\n\nRace timeline (Path A):\n\n Thread A (check_new_map) Thread B (another map update\n holds mdsc-\u003emutex or session teardown)\n -------------------------- --------------------------\n s = mdsc-\u003esessions[i]\n (refcount == 1, held only by\n sessions[] array)\n\n mutex_unlock(\u0026mdsc-\u003emutex)\n ---\u003e acquires mdsc-\u003emutex\n __unregister_session(mdsc, s)\n sessions[i] = NULL\n ceph_put_mds_session(s)\n refcount: 1 -\u003e 0\n kfree(s) \u003c--- freed!\n\n mutex_lock(\u0026s-\u003es_mutex)\n UAF on freed s-\u003es_mutex"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - check_new_map() runs from ceph_mdsc_handle_mdsmap() on CEPH_MSG_MDS_MAP received over TCP from a monitor (extra_mon_dispatch) or MDS (mds_dispatch); a malicious or compromised Ceph peer reaches the UAF on already-mounted CephFS clients without a local syscall.\nAC:L - A cluster attacker controls both race sides: one TCP session delivers an MDS map that drops mdsc-\u003emutex in the address-change, reconnect, or active-transition paths, while another concurrently sends a rank-removing map, CEPH_SESSION_CLOSE, or connection reset into __unregister_session(); Path B\u0027s send_mds_reconnect() GFP_NOFS work makes the window retryable.\nPR:N - The attacker acts as the remote MON/MDS peer, or an on-path attacker on a legacy unsigned msgr session, and needs no UID, capability, or init-namespace root on the victim; any kernel CephFS client already connected to that cluster is exposed.\nUI:N - Once CephFS is mounted, as is standard on Rook/Kubernetes, HPC, and cloud nodes, MDS-map updates and session teardown messages are processed automatically in ceph-msgr kworker context with no further victim mount, open, or interactive action.\nS:U - The session-object use-after-free corrupts kernel heap on the client host within the same security authority and does not inherently cross a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free of struct ceph_mds_session allows reclaim of the freed object so later reads of session fields, embedded connection state, and cap lists can disclose arbitrary kernel memory, matching CNA guidance that UAFs enable high confidentiality impact.\nI:H - The same reclaimed session is written (s_mutex, s_state, ceph_con_close, reconnect and cap-kick paths), enabling heap corruption and hijack of the embedded ceph_connection ops for arbitrary kernel writes and control-flow hijacking.\nA:H - Locking or dereferencing the freed session mutex and fields causes a kernel oops or panic, and the attacker can repeat map updates and session teardown to trigger the crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:32:33.412Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/989343b7ee5b1a08778be0c7c4bf6030d3910807"
},
{
"url": "https://git.kernel.org/stable/c/352a278d5a1965aae3f817ce5d24a67ee42d45d1"
},
{
"url": "https://git.kernel.org/stable/c/820871e9dbeecd2533c4c5f5d91878ceaf02324c"
},
{
"url": "https://git.kernel.org/stable/c/9646dfee880730aae4b379a4b8ee6c88ac735acd"
},
{
"url": "https://git.kernel.org/stable/c/21d5be092d947f8d83f76f7ebf3989e7e9230a98"
},
{
"url": "https://git.kernel.org/stable/c/ee611a7509554c4ca1f54f6aefe592fb1df7ea70"
}
],
"title": "ceph: fix UAF in check_new_map() on session freed during unlock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89654",
"datePublished": "2026-09-11T19:45:44.086Z",
"dateReserved": "2026-09-11T19:38:34.743Z",
"dateUpdated": "2026-10-30T12:32:33.412Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-89654\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T19:25:25.205939Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T19:25:25.766Z\"}}], \"cna\": {\"title\": \"ceph: fix UAF in check_new_map() on session freed during unlock\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - check_new_map() runs from ceph_mdsc_handle_mdsmap() on CEPH_MSG_MDS_MAP received over TCP from a monitor (extra_mon_dispatch) or MDS (mds_dispatch); a malicious or compromised Ceph peer reaches the UAF on already-mounted CephFS clients without a local syscall.\\nAC:L - A cluster attacker controls both race sides: one TCP session delivers an MDS map that drops mdsc-\u003emutex in the address-change, reconnect, or active-transition paths, while another concurrently sends a rank-removing map, CEPH_SESSION_CLOSE, or connection reset into __unregister_session(); Path B\u0027s send_mds_reconnect() GFP_NOFS work makes the window retryable.\\nPR:N - The attacker acts as the remote MON/MDS peer, or an on-path attacker on a legacy unsigned msgr session, and needs no UID, capability, or init-namespace root on the victim; any kernel CephFS client already connected to that cluster is exposed.\\nUI:N - Once CephFS is mounted, as is standard on Rook/Kubernetes, HPC, and cloud nodes, MDS-map updates and session teardown messages are processed automatically in ceph-msgr kworker context with no further victim mount, open, or interactive action.\\nS:U - The session-object use-after-free corrupts kernel heap on the client host within the same security authority and does not inherently cross a VM, IOMMU, or sandbox boundary.\\nC:H - Use-after-free of struct ceph_mds_session allows reclaim of the freed object so later reads of session fields, embedded connection state, and cap lists can disclose arbitrary kernel memory, matching CNA guidance that UAFs enable high confidentiality impact.\\nI:H - The same reclaimed session is written (s_mutex, s_state, ceph_con_close, reconnect and cap-kick paths), enabling heap corruption and hijack of the embedded ceph_connection ops for arbitrary kernel writes and control-flow hijacking.\\nA:H - Locking or dereferencing the freed session mutex and fields causes a kernel oops or panic, and the attacker can repeat map updates and session teardown to trigger the crash.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2f2dc053404febedc9c273452d9d518fb31fde72\", \"lessThan\": \"989343b7ee5b1a08778be0c7c4bf6030d3910807\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2f2dc053404febedc9c273452d9d518fb31fde72\", \"lessThan\": \"352a278d5a1965aae3f817ce5d24a67ee42d45d1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2f2dc053404febedc9c273452d9d518fb31fde72\", \"lessThan\": \"820871e9dbeecd2533c4c5f5d91878ceaf02324c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2f2dc053404febedc9c273452d9d518fb31fde72\", \"lessThan\": \"9646dfee880730aae4b379a4b8ee6c88ac735acd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2f2dc053404febedc9c273452d9d518fb31fde72\", \"lessThan\": \"21d5be092d947f8d83f76f7ebf3989e7e9230a98\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2f2dc053404febedc9c273452d9d518fb31fde72\", \"lessThan\": \"ee611a7509554c4ca1f54f6aefe592fb1df7ea70\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/ceph/mds_client.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.34\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.34\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.191\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.160\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.114\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.57\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.2.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.2.*\"}, {\"status\": \"unaffected\", \"version\": \"7.3\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/ceph/mds_client.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/989343b7ee5b1a08778be0c7c4bf6030d3910807\"}, {\"url\": \"https://git.kernel.org/stable/c/352a278d5a1965aae3f817ce5d24a67ee42d45d1\"}, {\"url\": \"https://git.kernel.org/stable/c/820871e9dbeecd2533c4c5f5d91878ceaf02324c\"}, {\"url\": \"https://git.kernel.org/stable/c/9646dfee880730aae4b379a4b8ee6c88ac735acd\"}, {\"url\": \"https://git.kernel.org/stable/c/21d5be092d947f8d83f76f7ebf3989e7e9230a98\"}, {\"url\": \"https://git.kernel.org/stable/c/ee611a7509554c4ca1f54f6aefe592fb1df7ea70\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: fix UAF in check_new_map() on session freed during unlock\\n\\ncheck_new_map() iterates mdsc-\u003esessions[] and for each active session\\ndrops mdsc-\u003emutex to perform per-session operations. The forced-close\\npath (rank removed from map) correctly takes a reference on s via\\nceph_get_mds_session() before releasing mdsc-\u003emutex, but three other\\npaths do not:\\n\\n Path A (address changed): mutex_unlock \\u2192 mutex_lock(\u0026s-\u003es_mutex)\\n Path B (reconnect): mutex_unlock \\u2192 send_mds_reconnect(mdsc, s)\\n Path C (active transition): mutex_unlock \\u2192 mutex_lock(\u0026s-\u003es_mutex)\\n\\nWithout the extra reference, another thread can acquire mdsc-\u003emutex\\nduring the unlock window, call __unregister_session() which drops the\\nlast reference on s, and free it. The original thread then accesses\\nfreed memory via s-\u003es_mutex.\\n\\nFix by adding ceph_get_mds_session(s) before each mutex_unlock and\\nceph_put_mds_session(s) after the corresponding mutex_lock, matching\\nthe pattern already used in the forced-close path.\\n\\nRace timeline (Path A):\\n\\n Thread A (check_new_map) Thread B (another map update\\n holds mdsc-\u003emutex or session teardown)\\n -------------------------- --------------------------\\n s = mdsc-\u003esessions[i]\\n (refcount == 1, held only by\\n sessions[] array)\\n\\n mutex_unlock(\u0026mdsc-\u003emutex)\\n ---\u003e acquires mdsc-\u003emutex\\n __unregister_session(mdsc, s)\\n sessions[i] = NULL\\n ceph_put_mds_session(s)\\n refcount: 1 -\u003e 0\\n kfree(s) \u003c--- freed!\\n\\n mutex_lock(\u0026s-\u003es_mutex)\\n UAF on freed s-\u003es_mutex\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.191\", \"versionStartIncluding\": \"2.6.34\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.160\", \"versionStartIncluding\": \"2.6.34\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.114\", \"versionStartIncluding\": \"2.6.34\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.57\", \"versionStartIncluding\": \"2.6.34\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.2.4\", \"versionStartIncluding\": \"2.6.34\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.3\", \"versionStartIncluding\": \"2.6.34\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-10-30T12:32:33.412Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-89654\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-30T12:32:33.412Z\", \"dateReserved\": \"2026-09-11T19:38:34.743Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-09-11T19:45:44.086Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…