{"metadata": {"vulnerability": "CVE-2026-98918", "count": 28, "kinds": {"milestone": 9, "sighting": 1, "kev": 0, "other": 18}}, "data": [{"timestamp": "2026-09-25T10:25:14.380Z", "date_only": false, "value": "2026-09-25T10:25:14.380Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-98918", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:01:50.803Z", "date_only": false, "value": "2026-10-23T12:01:50.803Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98918", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T12:05:05.149Z", "date_only": false, "value": "2026-10-23T12:05:05.149Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-98918", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T12:05:05.149Z", "date_only": false, "value": "2026-10-23T12:05:05.149Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-98918", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T12:40:57.114Z", "date_only": false, "value": "2026-10-23T12:40:57.114588Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490270642022319", "record": "CVE-2026-98918", "field": "creation_timestamp", "uuid": "dbe33057-b386-40d0-8452-6a7546ca14d8", "content": "CVE-2026-98918 mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold() In the Linux kernel, the following vulnerability has been resolved:\nmm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()\n__damon_va_prepare_access_check() picks a random byte address within theregion and stores it in r->sampling_addr.  damon_va_mkold() passes it intoa page table walk, which hands it to damon_ptep_mkold() as the address ofthe page to sample:\n  damon_va_mkold(mm, r->sampling_addr)    damon_va_walk_page_range(mm, addr, addr + 1)      damon_mkold_pmd_entry()        damon_ptep_mkold(pte, vma, addr)          ptep_test_and_clear_young(vma, addr, pte)          mmu_notifier_clear_young(mm, addr, addr + PAGE_SIZE)\nFor arm64, before commit 6f0e1142173a (\"arm64: mm: support batch clearingof the young flag for large folios\"), the contpte helper walked exactlyCONT_PTES entries from the aligned-down page table pointer and used @addronly to pass down to each entry, so an unaligned value was harmless:\n        ptep = contpte_align_down(ptep);        addr = ALIGN_DOWN(addr, CONT_PTE_SIZE);        for (i = 0; i < CONT_PTES; i++, ptep++, addr += PAGE_SIZE)\nNow the range to walk is derived from @addr instead: end = addr + nr *PAGE_SIZE, rounded up to CONT_PTE_SIZE.  For a sample in the last page ofa contpte block, the sub-page offset puts end just past the blockboundary, so the round-up lands a whole block further and the walk clearsPTE_AF in CONT_PTES entries beyond the sampled block.  For the last blockin a page table page, those entries are past the end of that page, so thewalk writes into the page that follows.\nTriggered by the full 7.1/7.2 kernel selftest suite on arm64 (EC2c/m6g.4xlarge).  The kernel sometimes crashes at or shortly after theDAMON test.\nWhat the overrun does depends on the page that happens to follow the pagetable, so there is no single signature.  If that page is read-only, thewrite faults in the sampling path itself:\n  Unable to handle kernel write to read-only memory at virtual address ffff0003c5d2d000    FSC = 0x0f: level 3 permission fault    CM = 0, WnR = 1, TnD = 0, TagAccess = 0  CPU: 10 UID: 0 PID: 3487 Comm: kdamond.2  pc : contpte_test_and_clear_young_ptes+0x70/0xc0  lr : damon_ptep_mkold+0x1e8/0x1f8  Call trace:   contpte_test_and_clear_young_ptes+0x70/0xc0 (P)   damon_mkold_pmd_entry+0x150/0x170   walk_pmd_range+0x110/0x2b0   walk_pud_range+0x10c/0x208   walk_pgd_range+0x134/0x258   __walk_page_range+0x98/0x1b0   walk_page_range_vma_unsafe+0x90/0x148   walk_page_range_vma+0x28/0x40   damon_va_walk_page_range+0x114/0x2b8   damon_va_prepare_access_checks+0xec/0x1a8   kdamond_fn+0x534/0x770   kthread+0x128/0x138   ret_from_fork+0x10/0x20\nOtherwise the page is writable, the PTE_AF clearing succeeds silently andthe damage only surfaces later, in whatever happened to own the page, sothe backtrace is unrelated to DAMON and differs between runs.\nPass a page-aligned address to the ptep_test_and_clear_young() call indamon_ptep_mkold(), which is the only place DAMON can reachcontpte_test_and_clear_young_ptes() from.  Nothing else sees the alignedaddress, and r->sampling_addr itself is left as is, so the sampling andregion bookkeeping semantics are unchanged.\nhttps://www.cve.org/CVERecord?id=CVE-2026-98918https://git.kernel.org/stable/c/d5208de0799c506d3315b6f96d034c38e4509dbbhttps://git.kernel.org/stable/c/f166586f74dd5d9cbadaabf86ef81c8ddf6cafa7#kernel #Linux#CVE_2026_98918#bot", "url": "https://infosec.exchange/users/cve/statuses/117490270642022319"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98918", "record": "UBUNTU-CVE-2026-98918", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:12Z", "date_only": false, "value": "2026-10-23T13:17:12Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-2Q7X-49G7-VWPM", "record": "GHSA-2Q7X-49G7-VWPM", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-23T13:17:12.360Z", "date_only": false, "value": "2026-10-23T13:17:12.360", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98918", "record": "FKIE_CVE-2026-98918", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:12.360Z", "date_only": false, "value": "2026-10-23T13:17:12.360", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98918", "record": "FKIE_CVE-2026-98918", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-23T15:31:30Z", "date_only": false, "value": "2026-10-23T15:31:30Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2Q7X-49G7-VWPM", "record": "GHSA-2Q7X-49G7-VWPM", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T15:31:30Z", "date_only": false, "value": "2026-10-23T15:31:30Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2Q7X-49G7-VWPM", "record": "GHSA-2Q7X-49G7-VWPM", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-25T23:00:00Z", "date_only": false, "value": "2026-10-25T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-25T23:00:00Z", "date_only": false, "value": "2026-10-25T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T23:00:00Z", "date_only": false, "value": "2026-10-25T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "vulnerabilities.49.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T06:07:49.658Z", "date_only": false, "value": "2026-10-28T06:07:49.658287Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98918", "record": "BELL-CVE-2026-98918", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T06:31:38.985Z", "date_only": false, "value": "2026-10-28T06:31:38.985087Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98918", "record": "BELL-CVE-2026-98918", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-28T06:31:38.985Z", "date_only": false, "value": "2026-10-28T06:31:38.985087Z", "kind": "other", "label": "Withdrawn", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98918", "record": "BELL-CVE-2026-98918", "field": "withdrawn", "linked_record": true}, {"timestamp": "2026-11-02T23:00:00Z", "date_only": false, "value": "2026-11-02T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-03T00:00:00Z", "date_only": true, "value": "2026-11-03", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1469", "record": "CERTFR-2026-AVI-1469", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-11-03T23:00:00Z", "date_only": false, "value": "2026-11-03T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-04T23:00:00Z", "date_only": false, "value": "2026-11-04T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-11-05T23:00:00Z", "date_only": false, "value": "2026-11-05T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.revision_history.4.date", "linked_record": true}, {"timestamp": "2026-11-05T23:00:00Z", "date_only": false, "value": "2026-11-05T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-06T00:00:00Z", "date_only": false, "value": "2026-11-06T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1469", "record": "CERTFR-2026-AVI-1469", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-11-06T00:00:00Z", "date_only": false, "value": "2026-11-06T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1469", "record": "CERTFR-2026-AVI-1469", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-06T00:00:00Z", "date_only": false, "value": "2026-11-06T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1469", "record": "CERTFR-2026-AVI-1469", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-11-06T10:51:12Z", "date_only": false, "value": "2026-11-06T10:51:12Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98918", "record": "UBUNTU-CVE-2026-98918", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-06T13:10:23.054Z", "date_only": false, "value": "2026-11-06T13:10:23.054+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.generator.date", "linked_record": true}], "metrics": {"as_of": "2026-11-08T12:30:38.586Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:01:50.803Z", "date_only": false, "value": "2026-10-23T12:01:50.803Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98918", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:01:50.803Z", "date_only": false, "value": "2026-10-23T12:01:50.803Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98918", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1384127.783189, "hours": 384.47993977472225, "days": 16.019997490613427, "min_seconds": 1384127.783189, "max_seconds": 1384127.783189, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:01:50.803Z", "date_only": false, "value": "2026-10-23T12:01:50.803Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98918", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-08T12:30:38.586Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}