KUNBUS piControl CVE-2026-13197

Exploitation requires local access to a host running KUNBUS piControl version 2.6.2, specifically with the ability to open and issue crafted requests to the piControl character device (typically /dev/piControl0). The attacker must hold at minimum a low-privilege authenticated local account with permissions to access the device node - unauthenticated or remote exploitation is not possible per the AV:L/PR:L CVSS metrics. The race condition itself imposes high attack complexity (AC:H) and specific attack prerequisites (AT:P from the 4.0 vector), meaning the attacker must successfully time concurrent device requests within a narrow kernel execution window, which is inherently unreliable. Limiting factors: no remote vector exists; valid local credentials with device access are required; race conditions are non-deterministic and may require repeated attempts; only version 2.6.2 is explicitly confirmed vulnerable. The configuration and process-image management functionality must be in active use for the relevant kernel code paths to be reachable.

The CVSS 4.0 score of 7.3 with vector AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N encodes several meaningful constraints that collectively moderate real-world exploitability. Local access is required (AV:L) - no remote exploitation path exists. High attack complexity (AC:H) reflects that winning a kernel-level race condition requires precise timing and is not reliably repeatable. The AT:P metric confirms specific attack prerequisites must be present, consistent with needing concurrent device access. Authentication at low privilege is required (PR:L), ruling out fully anonymous exploitation. The high C/I/A impact metrics in the 4.0 vector suggest the research team assessed potential for full kernel compromise beyond just denial of service, though the written description confirms only DoS as a demonstrated outcome. EPSS data is absent from available intelligence, preventing probability-based prioritization. No KEV listing exists, and no public exploit code has been identified - these are consistent signals of a newly disclosed, researcher-reported vulnerability without widespread threat actor interest yet. In OT/ICS deployments, the local access requirement is partially offset by shared multi-user RevPi environments where several low-privilege accounts may legitimately interact with the piControl device, narrowing the gap between theoretical and practical exploitation.

A low-privilege local user on a RevPi host running piControl 2.6.2 spawns multiple concurrent threads, each issuing crafted configuration or process-image management requests to the /dev/piControl0 character device. The lack of adequate synchronization creates a window where one thread frees a kernel configuration object while a sibling thread holds a stale pointer and dereferences it, triggering kernel memory corruption and a system crash. No public proof-of-concept has been identified, and the race window timing requirement elevates practical complexity.