CVE-2026-13197
Received Received - Intake

Race Condition in KUNBUS piControl Kernel Memory Corruption

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: Nozomi Networks Inc.

Description
Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to trigger use-after-free and invalid pointer dereferences on kernel configuration objects, resulting in kernel memory corruption and denial of service, by issuing concurrent crafted requests through the piControl character device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-13197
EUVD
EUVD-2026-58673

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kunbus pictrol 2.6.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition vulnerability in KUNBUS piControl version 2.6.2 where a local authenticated attacker can exploit improper synchronization in configuration and process-image management. By sending concurrent crafted requests through the piControl character device, the attacker triggers use-after-free errors and invalid pointer dereferences on kernel configuration objects, leading to kernel memory corruption and denial of service.

Detection Guidance

This vulnerability involves a race condition in KUNBUS piControl version 2.6.2 that could lead to kernel memory corruption. Detection may require monitoring for unusual kernel behavior or crashes during concurrent requests to the piControl character device. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow an attacker to corrupt kernel memory and cause a denial of service on the affected system. This may result in system crashes, instability, or loss of functionality for services relying on the piControl device.

Compliance Impact

The vulnerability involves a race condition leading to kernel memory corruption and denial of service, which could disrupt system integrity and availability. This may impact compliance with standards like GDPR (data integrity/availability) or HIPAA (system reliability) if exploited in affected environments.

Mitigation Strategies

Update KUNBUS piControl to the latest version beyond 2.6.2 to address the race condition vulnerability. Restrict local authenticated user access to the piControl character device to minimize attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13197. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart