{"metadata": {"vulnerability": "CVE-2026-99018", "count": 19, "kinds": {"milestone": 7, "sighting": 2, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-25T10:25:14.386Z", "date_only": false, "value": "2026-09-25T10:25:14.386Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99018", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:20:54.888Z", "date_only": false, "value": "2026-10-23T12:20:54.888Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99018", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99018", "record": "UBUNTU-CVE-2026-99018", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:24Z", "date_only": false, "value": "2026-10-23T13:17:24Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7X79-HRPM-VW9W", "record": "GHSA-7X79-HRPM-VW9W", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-23T13:17:24.650Z", "date_only": false, "value": "2026-10-23T13:17:24.650", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99018", "record": "FKIE_CVE-2026-99018", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:52:15.325Z", "date_only": false, "value": "2026-10-23T13:52:15.325233Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490551012271654", "record": "CVE-2026-99018", "field": "creation_timestamp", "uuid": "2c4b28bb-3dc7-4f1c-a0e1-86a13632337a", "content": "CVE-2026-99018 riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp In the Linux kernel, the following vulnerability has been resolved:\nriscv: entry: gate shadow call stack reload on sstatus.SPP, not tp\nUnder CONFIG_SHADOW_CALL_STACK, handle_exception() reloads the kernelshadow call stack pointer (gp) only when the trap came from userspace.It made that decision with scs_load_current_if_task_changed, whichcompares the trap-time tp (read back from sscratch into s5) against thecurrent tp:\n\tbeq\t\\prev, tp, _skip_scs\tscs_load_current_skip_scs:\ntp is a user-writable register.  A user task that sets tp to thelinear-map address of its own task_struct (&current) before trappingmakes the comparison succeed (can achieve by brute force with KASLRenable under our test), so the kernel skips scs_load_current andkeeps running with the gp that userspace left in place.  UnderCONFIG_SHADOW_CALL_STACK gp is the shadow call stack pointer andload_global_pointer is a no-op, so the compiler-emitted\"sd ra, -8(gp)\" / \"ld ra, -8(gp)\" in every non-leaf function then writeto, and return through, an attacker-controlled address -- anunprivileged kernel arbitrary-write and control-flow-hijack primitive.The poisoned gp is saved to task_struct.scs_sp on return, so the reloadis skipped on every subsequent entry as well.\nDecide \"came from userspace\" from the hardware sstatus.SPP bit (alreadyin s1 at this point) instead of from tp, mirroring the check thatret_from_exception already uses a few instructions later.  SPP iswritten by hardware on trap entry and cannot be forged from U-mode.Legitimate behaviour is unchanged: user entries (SPP=0) reload the taskshadow call stack, nested kernel entries (SPP=1) skip it.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99018https://git.kernel.org/stable/c/6639735367a7d491977e9e5e7afc50b489d81d83https://git.kernel.org/stable/c/7d1367a53137e379498eb8791295e58854378636https://git.kernel.org/stable/c/37b4401ee6fa06046446d55e97e8d11784080843https://git.kernel.org/stable/c/4d0697f192975dab5985e921989be1d85cf580e9#kernel #Linux#CVE_2026_99018#bot", "url": "https://infosec.exchange/users/cve/statuses/117490551012271654"}, {"timestamp": "2026-10-23T15:31:35Z", "date_only": false, "value": "2026-10-23T15:31:35Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7X79-HRPM-VW9W", "record": "GHSA-7X79-HRPM-VW9W", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-24T14:10:05.883Z", "date_only": false, "value": "2026-10-24T14:10:05.883Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99018", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-24T14:10:05.883Z", "date_only": false, "value": "2026-10-24T14:10:05.883Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99018", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-24T14:16:52.920Z", "date_only": false, "value": "2026-10-24T14:16:52.920", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99018", "record": "FKIE_CVE-2026-99018", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-24T15:32:50Z", "date_only": false, "value": "2026-10-24T15:32:50Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7X79-HRPM-VW9W", "record": "GHSA-7X79-HRPM-VW9W", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-25T01:04:40Z", "date_only": false, "value": "2026-10-25T01:04:40.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99018", "record": "MSRC_CVE-2026-99018", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-25T01:04:40Z", "date_only": false, "value": "2026-10-25T01:04:40.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99018", "record": "MSRC_CVE-2026-99018", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T01:04:40Z", "date_only": false, "value": "2026-10-25T01:04:40.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99018", "record": "MSRC_CVE-2026-99018", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-10-25T07:01:02.655Z", "date_only": false, "value": "2026-10-25T07:01:02.655Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99018", "record": "MSRC_CVE-2026-99018", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-10-26T01:46:06.556Z", "date_only": false, "value": "2026-10-26T01:46:06.556522Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3myqlz5qhwf2l", "record": "CVE-2026-99018", "field": "creation_timestamp", "uuid": "fc08ff3e-1ca0-4acf-90cf-6dd4140f9756", "content": "\ud83d\udfe0 CVE-2026-99018 - High (7.8)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nriscv: entry: gate shadow ca...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-99018/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3myqlz5qhwf2l"}, {"timestamp": "2026-10-28T06:07:55.823Z", "date_only": false, "value": "2026-10-28T06:07:55.823469Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99018", "record": "BELL-CVE-2026-99018", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T19:03:33Z", "date_only": false, "value": "2026-10-30T19:03:33Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99018", "record": "UBUNTU-CVE-2026-99018", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T06:23:57.990Z", "date_only": false, "value": "2026-11-03T06:23:57.99065Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99018", "record": "BELL-CVE-2026-99018", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-03T14:56:14.738Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:20:54.888Z", "date_only": false, "value": "2026-10-23T12:20:54.888Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99018", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:20:54.888Z", "date_only": false, "value": "2026-10-23T12:20:54.888Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99018", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 959719.850322, "hours": 266.58884731166665, "days": 11.107868637986112, "min_seconds": 959719.850322, "max_seconds": 959719.850322, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:20:54.888Z", "date_only": false, "value": "2026-10-23T12:20:54.888Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99018", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-03T14:56:14.738Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}