{"metadata": {"vulnerability": "CVE-2026-99039", "count": 15, "kinds": {"milestone": 5, "sighting": 1, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-25T10:25:14.387Z", "date_only": false, "value": "2026-09-25T10:25:14.387Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99039", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:21:57.421Z", "date_only": false, "value": "2026-10-23T12:21:57.421Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99039", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-23T12:21:57.421Z", "date_only": false, "value": "2026-10-23T12:21:57.421Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99039", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T12:21:57.421Z", "date_only": false, "value": "2026-10-23T12:21:57.421Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99039", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T13:17:27Z", "date_only": false, "value": "2026-10-23T13:17:27Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-R8CV-6PG4-74WG", "record": "GHSA-R8CV-6PG4-74WG", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-23T13:17:27.223Z", "date_only": false, "value": "2026-10-23T13:17:27.223", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99039", "record": "FKIE_CVE-2026-99039", "field": "published"}, {"timestamp": "2026-10-23T13:17:27.223Z", "date_only": false, "value": "2026-10-23T13:17:27.223", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99039", "record": "FKIE_CVE-2026-99039", "field": "lastModified"}, {"timestamp": "2026-10-23T14:06:24.572Z", "date_only": false, "value": "2026-10-23T14:06:24.572821Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490606595552560", "record": "CVE-2026-99039", "field": "creation_timestamp", "uuid": "e288b411-beae-4536-a928-9be8a2fcce7c", "content": "CVE-2026-99039 memstick: core: wait for request completion before freeing card In the Linux kernel, the following vulnerability has been resolved:\nmemstick: core: wait for request completion before freeing card\nIn memstick_alloc_card() and memstick_set_rw_addr(),wait_for_completion_timeout() is used to wait for device identificationand address configuration requests to complete.\nThe memstick subsystem does not provide an abort or cancellationcallback in struct memstick_host for in-flight requests. Ifwait_for_completion_timeout() expires (for instance, when a USB transferor command retry is delayed), memstick_alloc_card() returns an error andfrees the memstick_dev structure via kfree(card).\nHowever, the host controller driver (such as rtsx_usb_ms) is stillrunning the request asynchronously in worker context. When the transfereventually finishes, the driver writes into host->req->data, whichpoints to memory inside the already freed card structure. This leads toa KASAN slab-use-after-free write:\n  BUG: KASAN: slab-use-after-free in ms_read_bytes+0x8fe/0x990  Write of size 1 at addr ffff88813c188079 by task kworker/1:5/5239  Workqueue: events rtsx_usb_ms_handle_req  Call Trace:   ms_read_bytes+0x8fe/0x990 drivers/memstick/host/rtsx_usb_ms.c:450   rtsx_usb_ms_issue_cmd drivers/memstick/host/rtsx_usb_ms.c:477 [inline]   rtsx_usb_ms_handle_req+0x557/0x1a00 drivers/memstick/host/rtsx_usb_ms.c:531   process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396   worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560   kthread+0x373/0x450 kernel/kthread.c:436\n  Allocated by task 1662:   memstick_alloc_card drivers/memstick/core/memstick.c:383 [inline]   memstick_check+0x2c1/0x10d0 drivers/memstick/core/memstick.c:452   process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396\n  Freed by task 1662:   kfree+0x20c/0x650 mm/slub.c:6792   memstick_alloc_card drivers/memstick/core/memstick.c:420 [inline]   memstick_check+0x72b/0x10d0 drivers/memstick/core/memstick.c:452   process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396\nHost controller drivers (rtsx_usb_ms, jmb38x_ms, tifm_ms, r592) alreadyimplement their own hardware and bus timeouts, and callers inmspro_block and ms_block already rely on wait_for_completion()unconditionally.\nReplace wait_for_completion_timeout() with wait_for_completion() inmemstick_set_rw_addr() and memstick_alloc_card() so that the cardstructure is never freed while an asynchronous request is in flight.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99039https://git.kernel.org/stable/c/c3ab92542475d59ae685cbb294e70ca4d0ba38e9https://git.kernel.org/stable/c/810580cf60edc75c9891c2de3225e4cda78e4d9fhttps://git.kernel.org/stable/c/f2795c50144d528dabc2cf2fd53c0f0c63a823a1https://git.kernel.org/stable/c/3af81770e2011c6ac7bb597a4af2e4f3591f928chttps://git.kernel.org/stable/c/aa0a37b5024d921e96ac4f8f487c8bfbf1f1a582#kernel #Linux#CVE_2026_99039#bot", "url": "https://infosec.exchange/users/cve/statuses/117490606595552560"}, {"timestamp": "2026-10-23T15:31:36Z", "date_only": false, "value": "2026-10-23T15:31:36Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-R8CV-6PG4-74WG", "record": "GHSA-R8CV-6PG4-74WG", "field": "published"}, {"timestamp": "2026-10-23T15:31:36Z", "date_only": false, "value": "2026-10-23T15:31:36Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-R8CV-6PG4-74WG", "record": "GHSA-R8CV-6PG4-74WG", "field": "modified"}, {"timestamp": "2026-10-25T01:04:18Z", "date_only": false, "value": "2026-10-25T01:04:18.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99039", "record": "MSRC_CVE-2026-99039", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-25T01:04:18Z", "date_only": false, "value": "2026-10-25T01:04:18.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99039", "record": "MSRC_CVE-2026-99039", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-25T01:05:20Z", "date_only": false, "value": "2026-10-25T01:05:20.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99039", "record": "MSRC_CVE-2026-99039", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-25T01:05:20Z", "date_only": false, "value": "2026-10-25T01:05:20.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99039", "record": "MSRC_CVE-2026-99039", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-25T07:01:02.673Z", "date_only": false, "value": "2026-10-25T07:01:02.673Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99039", "record": "MSRC_CVE-2026-99039", "field": "document.tracking.generator.date"}]}