CVE-2026-13198
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A race condition vulnerability in the event notification functionality of KUNBUS piControl version 2.6.2. A local authenticated attacker can corrupt kernel heap and event-list state and disclose a small amount of adjacent kernel memory by issuing concurrent crafted requests from multiple threads through the piControl character device.
Risk Assessment
The risk includes kernel memory corruption and denial of service, potentially disrupting system operation and compromising data confidentiality.
Recommendation
Update KUNBUS piControl to the latest patched version and restrict access to the character device to trusted users only.
Original NVD description (English source)
Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to corrupt kernel heap and event-list state and disclose a small amount of adjacent kernel memory, resulting in kernel memory corruption and denial of service, by issuing concurrent crafted requests from multiple threads through the piControl character device.