CVE-2026-13198 is a race condition vulnerability in KUNBUS piControl 2.6.2's event notification functionality. It arises from improper synchronization during concurrent execution using shared resources. An authenticated local attacker can exploit this by sending concurrent crafted requests from multiple threads via the piControl character device, causing kernel heap corruption, partial disclosure of adjacent kernel memory, and denial of service conditions. The CVSS 4.0 score is 5.9 (medium severity), reflecting the need for local privileges and high attack complexity.

Successful exploitation results in kernel memory corruption, partial disclosure of adjacent kernel memory, and denial of service. The attacker must be locally authenticated and have the ability to issue concurrent requests. The vulnerability does not allow remote exploitation or require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users and monitor for unusual concurrent access patterns to the piControl character device.