CVE-2026-13197: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl

Published Aug 14, 2026

Updated

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to trigger use-after-free and invalid pointer dereferences on kernel configuration objects, resulting in kernel memory corruption and denial of service, by issuing concurrent crafted requests through the piControl character device.

Affected Software

1 affected component

Kunbus piControl=2.6.2

Event History

Aug 14, 2026

CVE Published

via MITRE·03:01 PM

Data Sourced

via MITRE·03:01 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2026-13197?

CVE-2026-13197 has a risk score of 46, indicating a moderate severity level.

How do I fix CVE-2026-13197?

Fixing CVE-2026-13197 requires updating KUNBUS piControl to a secure version that addresses the race condition vulnerability.

What type of vulnerability is CVE-2026-13197?

CVE-2026-13197 is classified as a race condition vulnerability under CWE-362.

Who can exploit CVE-2026-13197?

CVE-2026-13197 can be exploited by a local authenticated attacker with access to the KUNBUS piControl system.

What impact does CVE-2026-13197 have on KUNBUS piControl?

CVE-2026-13197 allows attackers to potentially interfere with configuration and process-image management functions.