{"metadata": {"vulnerability": "CVE-2026-98959", "count": 33, "kinds": {"milestone": 8, "sighting": 1, "kev": 0, "other": 24}}, "data": [{"timestamp": "2026-09-25T10:25:14.382Z", "date_only": false, "value": "2026-09-25T10:25:14.382Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-98959", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:19:27.679Z", "date_only": false, "value": "2026-10-23T12:19:27.679Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98959", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:08:31.878Z", "date_only": false, "value": "2026-10-23T13:08:31.878631Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490379091237110", "record": "CVE-2026-98959", "field": "creation_timestamp", "uuid": "93249256-5db7-4c66-bd11-557efa8cd629", "content": "CVE-2026-98959 btrfs: fix xattr replace when multiple xattrs are packed in the same item In the Linux kernel, the following vulnerability has been resolved:\nbtrfs: fix xattr replace when multiple xattrs are packed in the same item\nIf we have a btrfs_dir_item item that packs multiple xattrs and then wereplace the value of one of them (with the setxattr(2) family of syscalls)with another value of a different size, we end up not having a fullyinitialized btrfs_dir_item, resulting in a corruption that the treechecker will detect at extent buffer writeback time.\nThis is because in btrfs_setxattr() when we find a btrfs_dir_item withmultiple xattrs (due to the crc32c hash of their name being the same)we delete one of the xattr items (btrfs_dir_item) and then insert a newone, but the deletion and insertion results in shifting existing data inthe leaf and therefore when the new value of a xattr has a different size,the new btrfs_dir_item is placed in a leaf section that was notinitialized and we only copy the value's data and set the value's lengthin the new btrfs_dir_item, without setting the name, the name's length,the key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) andtransaction ID.\nThe following script reproduces the issue:\n  $ cat test.sh  #!/bin/bash\n  DEV=/dev/sdi  MNT=/mnt/sdi\n  mkfs.btrfs -f $DEV  mount $DEV $MNT\n  touch $MNT/testfile\n  # Add two xattrs that, on btrfs, have the same hash (crc32c) for their  # name and therefore are packed into the same btrfs_dir_item.  setfattr -n user.foobar -v 123 $MNT/testfile  setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile\n  # Verify the xattrs are present.  echo \"xattrs before:\"  getfattr --absolute-names --dump $MNT/testfile\n  # Now replace the value of the foobar xattr with a significantly larger  # value.  setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile\n  # Check the xattrs have the expected values.  echo \"xattrs after:\"  getfattr --absolute-names --dump $MNT/testfile\n  umount $MNT\nRunning it:\n  $ ./test.sh  (...)  xattrs before:  # file: /mnt/sdi/testfile  user.WvG1c1Td=\"qwerty\"  user.foobar=\"123\"\n  xattrs after:  # file: /mnt/sdi/testfile  user.WvG1c1Td=\"qwerty\"\nSo the \"user.foobar\" xattr is missing and there was a transaction abortwhen unmounting the fs with the following traces in dmesg:\n  $ dmesg  [869800.159271] BTRFS warning (device sdi): access to eb bytenr 30474240 len 16384 out of range start 16015 len 25964  [869800.159293] ------------[ cut here ]------------  [869800.159296] WARNING: fs/btrfs/extent_io.c:4408 at report_eb_range+0x44/0x60 [btrfs], CPU#8: getfattr/2605179  [869800.168961] Modules linked in: btrfs dm_thin_pool (...)  [869800.190527] CPU: 8 UID: 0 PID: 2605179 Comm: getfattr Tainted: G        W           7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full)  [869800.193726] Tainted: [W]=WARN  [869800.194502] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014  [869800.197576] RIP: 0010:report_eb_range+0x44/0x60 [btrfs]  [869800.198985] Code: 48 8b 7b 18 (...)  [869800.203531] RSP: 0018:ffffce4541937d58 EFLAGS: 00010246  [869800.204609] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000  [869800.206137] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc04c92a0  [869800.207645] RBP: 0000000000003e8f R08: 0000000000000000 R09: 3fffffffffefffff  [869800.226175] R10: ffffce4541937a88 R11: 0000000000000003 R12: 000000000000656c  [869800.227594] R13: ffff8dde14be800f R14: 000000000000656c R15: 0000000000000069  [869800.229097] FS:  00007f59023bb780(0000) GS:ffff8de5788ed000(0000) knlGS:0000000000000000  [869800.231137] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  [869800.232321] CR2: 0000558dc45e6a78 CR3: 0000000765b16004 CR4: 0000000000370ef0  [869800.233783] Call Trace:  [869800.234330]  <TASK>  [869800.234791]  read_extent_buffer+0x4d/0x100 [btrfs]  [869800.235898]  btrfs_listxattr+0x199/0x240 [btrfs]  [869800.236912]  vfs_listxattr+0x51/0---truncated---\nhttps://www.cve.org/CVERecord?id=CVE-2026-98959https://git.kernel.org/stable/c/7a53bb4668b319fc6c8a3ce2c21635125c7d2712https://git.kernel.org/stable/c/5877d7138cc4359d26fd7b010eedfd1b3162348fhttps://git.kernel.org/stable/c/a97114b9b00ed3d05156f3b2ddbf797296260389https://git.kernel.org/stable/c/c1803697a60f22743aa28ad522f805e92d45e3f0https://git.kernel.org/stable/c/858bee1c77857aabcc2327cd32dd8266332de332#kernel #Linux#CVE_2026_98959#bot", "url": "https://infosec.exchange/users/cve/statuses/117490379091237110"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98959", "record": "UBUNTU-CVE-2026-98959", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:17Z", "date_only": false, "value": "2026-10-23T13:17:17Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-CF5F-CWF6-82GC", "record": "GHSA-CF5F-CWF6-82GC", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-23T13:17:17.233Z", "date_only": false, "value": "2026-10-23T13:17:17.233", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98959", "record": "FKIE_CVE-2026-98959", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T15:31:32Z", "date_only": false, "value": "2026-10-23T15:31:32Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CF5F-CWF6-82GC", "record": "GHSA-CF5F-CWF6-82GC", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-24T01:09:52Z", "date_only": false, "value": "2026-10-24T01:09:52.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98959", "record": "MSRC_CVE-2026-98959", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-24T01:09:52Z", "date_only": false, "value": "2026-10-24T01:09:52.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98959", "record": "MSRC_CVE-2026-98959", "field": "vulnerabilities.0.remediations.0.date", "linked_record": true}, {"timestamp": "2026-10-24T01:09:52Z", "date_only": false, "value": "2026-10-24T01:09:52.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98959", "record": "MSRC_CVE-2026-98959", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-24T01:09:52Z", "date_only": false, "value": "2026-10-24T01:09:52.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98959", "record": "MSRC_CVE-2026-98959", "field": "vulnerabilities.0.remediations.1.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-24T14:09:39.735Z", "date_only": false, "value": "2026-10-24T14:09:39.735Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-98959", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-24T14:09:39.735Z", "date_only": false, "value": "2026-10-24T14:09:39.735Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-98959", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-24T14:16:49.307Z", "date_only": false, "value": "2026-10-24T14:16:49.307", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98959", "record": "FKIE_CVE-2026-98959", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-24T15:32:47Z", "date_only": false, "value": "2026-10-24T15:32:47Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CF5F-CWF6-82GC", "record": "GHSA-CF5F-CWF6-82GC", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-25T01:02:19Z", "date_only": false, "value": "2026-10-25T01:02:19.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98959", "record": "MSRC_CVE-2026-98959", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-25T23:00:00Z", "date_only": false, "value": "2026-10-25T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-25T23:00:00Z", "date_only": false, "value": "2026-10-25T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T23:00:00Z", "date_only": false, "value": "2026-10-25T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "vulnerabilities.90.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-26T14:48:02Z", "date_only": false, "value": "2026-10-26T14:48:02.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98959", "record": "MSRC_CVE-2026-98959", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-10-28T06:07:52.176Z", "date_only": false, "value": "2026-10-28T06:07:52.176495Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98959", "record": "BELL-CVE-2026-98959", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-01T15:01:43Z", "date_only": false, "value": "2026-11-01T15:01:43.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98959", "record": "MSRC_CVE-2026-98959", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-11-02T23:00:00Z", "date_only": false, "value": "2026-11-02T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-03T06:23:54.716Z", "date_only": false, "value": "2026-11-03T06:23:54.716247Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98959", "record": "BELL-CVE-2026-98959", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T23:00:00Z", "date_only": false, "value": "2026-11-03T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-04T23:00:00Z", "date_only": false, "value": "2026-11-04T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-11-05T14:55:51Z", "date_only": false, "value": "2026-11-05T14:55:51.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98959", "record": "MSRC_CVE-2026-98959", "field": "document.tracking.revision_history.4.date", "linked_record": true}, {"timestamp": "2026-11-05T14:55:51Z", "date_only": false, "value": "2026-11-05T14:55:51.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98959", "record": "MSRC_CVE-2026-98959", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-05T23:00:00Z", "date_only": false, "value": "2026-11-05T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.revision_history.4.date", "linked_record": true}, {"timestamp": "2026-11-05T23:00:00Z", "date_only": false, "value": "2026-11-05T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-06T08:02:51.372Z", "date_only": false, "value": "2026-11-06T08:02:51.372Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98959", "record": "MSRC_CVE-2026-98959", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-06T13:10:23.054Z", "date_only": false, "value": "2026-11-06T13:10:23.054+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4152", "record": "WID-SEC-W-2026-4152", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-06T17:25:47Z", "date_only": false, "value": "2026-11-06T17:25:47Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98959", "record": "UBUNTU-CVE-2026-98959", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-08T14:24:37.571Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:19:27.679Z", "date_only": false, "value": "2026-10-23T12:19:27.679Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98959", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:19:27.679Z", "date_only": false, "value": "2026-10-23T12:19:27.679Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98959", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": {"timestamp": "2026-10-24T01:09:52Z", "date_only": false, "value": "2026-10-24T01:09:52.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98959", "record": "MSRC_CVE-2026-98959", "field": "vulnerabilities.0.remediations.1.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": false, "missing": ["start"]}, "disclosure_to_patch": {"available": true, "seconds": 46224.321, "hours": 12.840089166666667, "days": 0.5350037152777778, "min_seconds": 46224.321, "max_seconds": 46224.321, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:19:27.679Z", "date_only": false, "value": "2026-10-23T12:19:27.679Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98959", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-24T01:09:52Z", "date_only": false, "value": "2026-10-24T01:09:52.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98959", "record": "MSRC_CVE-2026-98959", "field": "vulnerabilities.0.remediations.1.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "time_unpatched": {"available": true, "seconds": 46224.321, "hours": 12.840089166666667, "days": 0.5350037152777778, "min_seconds": 46224.321, "max_seconds": 46224.321, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:19:27.679Z", "date_only": false, "value": "2026-10-23T12:19:27.679Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98959", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-24T01:09:52Z", "date_only": false, "value": "2026-10-24T01:09:52.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98959", "record": "MSRC_CVE-2026-98959", "field": "vulnerabilities.0.remediations.1.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}