KUNBUS piControl CVE-2026-13198

Exploitation requires: (1) local authenticated access to the target system (PR:L per CVSS 4.0 vector); (2) the ability to create multiple concurrent threads or processes that interact with the piControl character device (/dev/piControl) - the character device must be accessible to the attacker's user account; (3) successful timing of the race condition across concurrent threads (AC:H, AT:P), which is non-trivial and may require multiple attempts. The attack is limited to local vectors - remote unauthenticated exploitation is not possible. The race condition is specific to the event notification functionality of piControl, not the entire driver. Limiting factors include: local access requirement, high attack complexity, the need to win a kernel-level race, and the OT/ICS deployment context where multi-user local access is typically restricted by operational policy.

The CVSS 4.0 score of 5.9 with AV:L/AC:H/AT:P/PR:L appropriately calibrates this as a medium-severity, hard-to-exploit local vulnerability. Real-world risk is constrained by several factors: the attacker must already have local authenticated access to the system, must successfully win a multi-threaded race condition (AC:H, AT:P), and the product operates in OT/ICS environments where direct local access is typically tightly controlled. EPSS data is not provided in the input; no KEV listing and no public exploit code are known at time of analysis, consistent with a niche industrial component vulnerability unlikely to attract broad opportunistic exploitation. The integrity and availability impact (VI:H, VA:H) are the most significant risk signals - kernel heap corruption can cause unpredictable system behavior or crash, which in an OT context may disrupt industrial process control. The confidentiality impact (VC:L) is limited to a small amount of adjacent kernel memory, reducing data exfiltration risk. Overall, this is a real but narrowly exploitable vulnerability; organizations running piControl 2.6.2 in environments where multiple local users share system access should prioritize patching, while air-gapped single-operator deployments face lower realistic exposure.

A local authenticated user on a Revolution Pi system running piControl 2.6.2 spawns multiple threads that simultaneously issue crafted event notification requests to the /dev/piControl character device, winning a race window in the unsynchronized kernel path. Successful exploitation corrupts the kernel heap and event-list state, potentially crashing the kernel (denial of service) or leaking a small amount of adjacent kernel memory contents to the attacker. No public exploit code is known at time of analysis, and reproducing the race reliably requires careful timing, making this harder to weaponize than simpler memory corruption bugs.