{"metadata": {"vulnerability": "CVE-2026-98924", "count": 36, "kinds": {"milestone": 10, "sighting": 1, "kev": 0, "other": 25}}, "data": [{"timestamp": "2026-09-25T10:25:14.380Z", "date_only": false, "value": "2026-09-25T10:25:14.380Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-98924", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:03:50.230Z", "date_only": false, "value": "2026-10-23T12:03:50.230Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98924", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T12:05:50.501Z", "date_only": false, "value": "2026-10-23T12:05:50.501Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-98924", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T12:05:50.501Z", "date_only": false, "value": "2026-10-23T12:05:50.501Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-98924", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T12:45:00.495Z", "date_only": false, "value": "2026-10-23T12:45:00.495065Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490286571482948", "record": "CVE-2026-98924", "field": "creation_timestamp", "uuid": "986ff8ad-65c4-4002-8331-5111ef305786", "content": "CVE-2026-98924 fs: avoid repeated scans in evict_inodes() In the Linux kernel, the following vulnerability has been resolved:\nfs: avoid repeated scans in evict_inodes()\nWe observed hung tasks when users attempted to unmount a filesystemafter its disk had been removed while still in use. During deviceremoval, fs_bdev_mark_dead() calls evict_inodes() while holding s_umount.\nEach time evict_inodes() drops s_inode_list_lock to reschedule, itrestarts the walk from the head of s_inodes. With many referenced inodesat the head of the list, these restarts repeatedly scan the same inodeswithout reclaiming them. This can keep s_umount held for a long time,blocking concurrent umount attempts and triggering hung-task reports.\nKeep the current inode, already marked I_FREEING, out of the disposalbatch until s_inode_list_lock is reacquired. Resume the walk from thisinode and dispose of it in a later batch or at the end of the walk.\nThe zero-refcount and state checks under i_lock allow this walker toclaim the inode by setting I_FREEING and removing it from the LRU.Other reclaimers skip the inode, leaving this walker responsible foreviction. Only evict() removes it from s_inodes, so keeping it out ofthe disposal batch ensures that it remains on the list while the lockis dropped. After reacquiring the lock, reading its current next pointeraccounts for concurrent removal of following inodes.\nThe existing inode lifetime rules prohibit acquiring a reference to aninode marked I_FREEING or I_WILL_FREE. __iget() requires its caller tohold i_lock and establish that taking a reference is valid. Inode lookupand igrab() check these flags under i_lock when acquiring a referencefrom zero. ihold() requires an existing reference, which would keepi_count nonzero and prevent this walker from claiming the inode. Theserules already allow iput_final() and the inode shrinker to releasei_lock after setting I_FREEING and before eviction completes.\nA temporary __iget() reference would also keep the inode on the list,but its release must preserve last-reference handling. Another user canacquire a reference, update lazy timestamps and drop its reference whilethe pin is held. If the pin becomes the last reference, dropping it withatomic_dec_and_test() and evicting directly bypasses iput()'s lazytimehandling and can lose those timestamp updates.\nReleasing the pin with iput() preserves that handling, but does notguarantee eviction. fs_bdev_mark_dead() runs with SB_ACTIVE set, so iput()may retain the inode in cache, whereas evict_inodes() must evict eligiblezero-reference inodes. The inode may also have been freed when iput()returns, so the walker cannot then use it to force eviction. UsingI_FREEING preserves the existing eviction behavior without introducingan additional last-reference transition.\nThe xfstests auto group passed on ext4 and XFS with known unrelatedfailures excluded. No new issues were observed, and the previouslyreproducible hung task no longer occurs with this patch.\nhttps://www.cve.org/CVERecord?id=CVE-2026-98924https://git.kernel.org/stable/c/e4f3e476cd4066a815ef68cd6caa1828b9c167d5https://git.kernel.org/stable/c/3cdc6e12ff79f0f8a3ba62d7e61474ae4b5e119ahttps://git.kernel.org/stable/c/7459c021874246c196f397686e100702f059b9e7#kernel #Linux#CVE_2026_98924#bot", "url": "https://infosec.exchange/users/cve/statuses/117490286571482948"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98924", "record": "UBUNTU-CVE-2026-98924", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:13Z", "date_only": false, "value": "2026-10-23T13:17:13Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FCGW-J977-C8RV", "record": "GHSA-FCGW-J977-C8RV", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-23T13:17:13.083Z", "date_only": false, "value": "2026-10-23T13:17:13.083", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98924", "record": "FKIE_CVE-2026-98924", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:13.083Z", "date_only": false, "value": "2026-10-23T13:17:13.083", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98924", "record": "FKIE_CVE-2026-98924", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-23T15:31:31Z", "date_only": false, "value": "2026-10-23T15:31:31Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FCGW-J977-C8RV", "record": "GHSA-FCGW-J977-C8RV", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T15:31:31Z", "date_only": false, "value": "2026-10-23T15:31:31Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FCGW-J977-C8RV", "record": "GHSA-FCGW-J977-C8RV", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-24T01:07:52Z", "date_only": false, "value": "2026-10-24T01:07:52.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98924", "record": "MSRC_CVE-2026-98924", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-24T01:07:52Z", "date_only": false, "value": "2026-10-24T01:07:52.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98924", "record": "MSRC_CVE-2026-98924", "field": "vulnerabilities.0.remediations.0.date", "linked_record": true}, {"timestamp": "2026-10-24T01:07:52Z", "date_only": false, "value": "2026-10-24T01:07:52.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98924", "record": "MSRC_CVE-2026-98924", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T01:02:55Z", "date_only": false, "value": "2026-10-25T01:02:55.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98924", "record": "MSRC_CVE-2026-98924", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-25T23:00:00Z", "date_only": false, "value": "2026-10-25T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-25T23:00:00Z", "date_only": false, "value": "2026-10-25T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T23:00:00Z", "date_only": false, "value": "2026-10-25T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "vulnerabilities.55.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-26T14:46:22Z", "date_only": false, "value": "2026-10-26T14:46:22.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98924", "record": "MSRC_CVE-2026-98924", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-10-28T06:07:50.513Z", "date_only": false, "value": "2026-10-28T06:07:50.51391Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98924", "record": "BELL-CVE-2026-98924", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T06:31:39.392Z", "date_only": false, "value": "2026-10-28T06:31:39.392513Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98924", "record": "BELL-CVE-2026-98924", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-01T15:00:33Z", "date_only": false, "value": "2026-11-01T15:00:33.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98924", "record": "MSRC_CVE-2026-98924", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-11-02T23:00:00Z", "date_only": false, "value": "2026-11-02T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-03T00:00:00Z", "date_only": true, "value": "2026-11-03", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1469", "record": "CERTFR-2026-AVI-1469", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-11-03T23:00:00Z", "date_only": false, "value": "2026-11-03T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-04T23:00:00Z", "date_only": false, "value": "2026-11-04T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-11-05T14:53:42Z", "date_only": false, "value": "2026-11-05T14:53:42.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98924", "record": "MSRC_CVE-2026-98924", "field": "document.tracking.revision_history.4.date", "linked_record": true}, {"timestamp": "2026-11-05T14:53:42Z", "date_only": false, "value": "2026-11-05T14:53:42.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98924", "record": "MSRC_CVE-2026-98924", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-05T23:00:00Z", "date_only": false, "value": "2026-11-05T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.revision_history.4.date", "linked_record": true}, {"timestamp": "2026-11-05T23:00:00Z", "date_only": false, "value": "2026-11-05T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-06T00:00:00Z", "date_only": false, "value": "2026-11-06T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1469", "record": "CERTFR-2026-AVI-1469", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-11-06T00:00:00Z", "date_only": false, "value": "2026-11-06T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1469", "record": "CERTFR-2026-AVI-1469", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-06T00:00:00Z", "date_only": false, "value": "2026-11-06T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1469", "record": "CERTFR-2026-AVI-1469", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-11-06T08:02:51.321Z", "date_only": false, "value": "2026-11-06T08:02:51.321Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98924", "record": "MSRC_CVE-2026-98924", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-06T10:51:13Z", "date_only": false, "value": "2026-11-06T10:51:13Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98924", "record": "UBUNTU-CVE-2026-98924", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-06T13:10:23.054Z", "date_only": false, "value": "2026-11-06T13:10:23.054+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.generator.date", "linked_record": true}], "metrics": {"as_of": "2026-11-09T08:29:30.487Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:03:50.230Z", "date_only": false, "value": "2026-10-23T12:03:50.230Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98924", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:03:50.230Z", "date_only": false, "value": "2026-10-23T12:03:50.230Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98924", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1455940.257161, "hours": 404.4278492113889, "days": 16.85116038380787, "min_seconds": 1455940.257161, "max_seconds": 1455940.257161, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:03:50.230Z", "date_only": false, "value": "2026-10-23T12:03:50.230Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98924", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-09T08:29:30.487Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}