{"document":{"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-US","notes":[{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. KUNBUS RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.","title":"Legal Disclaimer"}],"publisher":{"category":"vendor","contact_details":"product-security@kunbus.com","issuing_authority":"KUNBUS GmbH develops and produces the Revolution Pi Family, Revolution Pi OS and the extension modules for RevPi amongst others. KUNBUS PSIRT is responsible for vulnerability handling across all KUNBUS products and services.","name":"KUNBUS PSIRT","namespace":"https://www.kunbus.com"},"references":[{"category":"self","summary":"URL generated by system","url":"https://psirt.kunbus.com/white/2026/kunbus-2026-0000008.json"}],"title":"Multiple Vulnerabilities in piControl Kernel Module","tracking":{"current_release_date":"2026-08-12T07:07:22.558587308Z","generator":{"date":"2026-08-06T08:48:32.857Z","engine":{"name":"csaf-cms-backend","version":"1.0.0-kunbus.1"}},"id":"Kunbus-2026-0000008","initial_release_date":"2026-07-27T08:01:00.000Z","revision_history":[{"date":"2026-07-27T08:01:00.000Z","number":"1.0.0","summary":"Initial Publication"},{"date":"2026-08-06T09:01:44.339809084Z","number":"1.1.0","summary":"Lower TLP and Adjust references"},{"date":"2026-08-12T07:07:22.558587308Z","number":"1.2.0","summary":"Remove the yet not available vulnerability references"}],"status":"final","version":"1.2.0"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version_range","name":"vers:deb/<=2.6.2-1+deb12+1","product":{"name":"KUNBUS picontrol vers:deb/=2.6.2-1+deb12+1","product_id":"CSAFPID-0001","product_identification_helper":{"purl":"pkg:deb/revolutionpi/picontrol@2.6.2-1+deb12+1"}}},{"category":"product_version","name":"vers:deb 2.7.0-1+deb13+1","product":{"name":"KUNBUS picontrol vers:deb 2.7.0-1+deb13+1","product_id":"CSAFPID-0002","product_identification_helper":{"purl":"pkg:deb/revolutionpi/picontrol@2.7.0-1+deb13+1"}}},{"category":"product_version","name":"vers:deb 2.8.0-1+deb13+1","product":{"name":"KUNBUS picontrol vers:deb 2.8.0-1+deb13+1","product_id":"CSAFPID-0003","product_identification_helper":{"purl":"pkg:deb/revolutionpi/picontrol@2.8.0-1+deb13+1"}}}],"category":"product_name","name":"picontrol"}],"category":"vendor","name":"KUNBUS"}]},"vulnerabilities":[{"acknowledgments":[{"names":["Gabriele Quagliarella"],"organization":"Nozomi Networks"}],"cve":"CVE-2026-13196","cwe":{"id":"CWE-787","name":"Out-of-bounds Write"},"notes":[{"category":"summary","text":"An authenticated User can modify the piControl config file to trigger an Array Out of Bounds Write. The config file is used to control the piControl Kernel Module which causes the vulnerability end up in kernel space.","title":"Array Out of Bounds Write in piControl Kernel module."}],"product_status":{"fixed":["CSAFPID-0002"],"known_affected":["CSAFPID-0001"]},"remediations":[{"category":"vendor_fix","date":"2026-07-17T10:00:00.000Z","details":"Upgrade to picontrol version 2.7.0","product_ids":["CSAFPID-0001"],"url":"https://packages.revolutionpi.com/pool/main/p/picontrol/picontrol_2.7.0-1+deb13+1_arm64.deb"}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","environmentalScore":7,"environmentalSeverity":"HIGH","exploitCodeMaturity":"PROOF_OF_CONCEPT","integrityImpact":"HIGH","privilegesRequired":"LOW","remediationLevel":"OFFICIAL_FIX","reportConfidence":"CONFIRMED","scope":"UNCHANGED","temporalScore":7,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","version":"3.1"},"products":["CSAFPID-0001"]}],"title":"Array index out of bounds read in picontrol kernel module"},{"acknowledgments":[{"names":["Gabriele Quagliarella"],"organization":"Nozomi Networks"}],"cve":"CVE-2026-13197","cwe":{"id":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"},"notes":[{"category":"summary","text":"A race condition in piControl Kernel module can lead to storage freed and reused while the original user is still waiting resulting in possible data corruption.","title":"TOCTOU in piControl"}],"product_status":{"fixed":["CSAFPID-0002"],"known_affected":["CSAFPID-0001"]},"remediations":[{"category":"vendor_fix","date":"2026-07-17T10:00:00.000Z","details":"Upgrade to picontrol version 2.7.0","product_ids":["CSAFPID-0001"],"url":"https://packages.revolutionpi.com/pool/main/p/picontrol/picontrol_2.7.0-1+deb13+1_arm64.deb"}],"scores":[{"cvss_v3":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","environmentalScore":6.3,"environmentalSeverity":"MEDIUM","exploitCodeMaturity":"PROOF_OF_CONCEPT","integrityImpact":"HIGH","privilegesRequired":"LOW","remediationLevel":"OFFICIAL_FIX","reportConfidence":"CONFIRMED","scope":"UNCHANGED","temporalScore":6.3,"temporalSeverity":"MEDIUM","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","version":"3.1"},"products":["CSAFPID-0001"]}],"title":"Race Condition in piControl Kernel module"},{"acknowledgments":[{"names":["Gabriele Quagliarella"],"organization":"Nozomi Networks"}],"cve":"CVE-2026-13198","cwe":{"id":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"},"notes":[{"category":"summary","text":"Race condition i event wakeup can corrupt the eventList used to manage those wakeup call.","title":"Possible internal datastructure corruption"}],"product_status":{"fixed":["CSAFPID-0003"],"known_affected":["CSAFPID-0001","CSAFPID-0002"]},"remediations":[{"category":"vendor_fix","date":"2026-07-17T10:00:00.000Z","details":"Upgrade to picontrol version 2.8.0","product_ids":["CSAFPID-0001","CSAFPID-0002"],"url":"https://packages.revolutionpi.com/pool/main/p/picontrol/picontrol_2.8.0-1+deb13+1_arm64.deb"}],"scores":[{"cvss_v3":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","environmentalScore":5.9,"environmentalSeverity":"MEDIUM","exploitCodeMaturity":"PROOF_OF_CONCEPT","integrityImpact":"HIGH","privilegesRequired":"LOW","remediationLevel":"OFFICIAL_FIX","reportConfidence":"CONFIRMED","scope":"UNCHANGED","temporalScore":5.9,"temporalSeverity":"MEDIUM","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H/E:P/RL:O/RC:C","version":"3.1"},"products":["CSAFPID-0001","CSAFPID-0002"]}],"title":"Race Condition with possible internal datastructure corruption"}]}