{"metadata": {"vulnerability": "CVE-2026-99062", "count": 18, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-25T10:25:14.388Z", "date_only": false, "value": "2026-09-25T10:25:14.388Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99062", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:23:03.360Z", "date_only": false, "value": "2026-10-23T12:23:03.360Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99062", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T12:23:03.360Z", "date_only": false, "value": "2026-10-23T12:23:03.360Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99062", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T12:23:03.360Z", "date_only": false, "value": "2026-10-23T12:23:03.360Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99062", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99062", "record": "UBUNTU-CVE-2026-99062", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:17:30Z", "date_only": false, "value": "2026-10-23T13:17:30Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-Q643-38MV-P69J", "record": "GHSA-Q643-38MV-P69J", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-23T13:17:30.020Z", "date_only": false, "value": "2026-10-23T13:17:30.020", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99062", "record": "FKIE_CVE-2026-99062", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:17:30.020Z", "date_only": false, "value": "2026-10-23T13:17:30.020", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99062", "record": "FKIE_CVE-2026-99062", "field": "lastModified"}, {"timestamp": "2026-10-23T14:21:56.200Z", "date_only": false, "value": "2026-10-23T14:21:56.200258Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490667388999916", "record": "CVE-2026-99062", "field": "creation_timestamp", "uuid": "2447e17a-e20a-4fff-b7c1-e76b465f4a2b", "content": "CVE-2026-99062 vsock/virtio: account only unread bytes in read_skb() In the Linux kernel, the following vulnerability has been resolved:\nvsock/virtio: account only unread bytes in read_skb()\nAfter a partial stream receive, rx_bytes tracks the unread suffix whilebuf_used and peer credit still cover the whole packet.virtio_transport_read_skb() dequeues that packet but passes pkt_len forboth counters, underflowing rx_bytes.\nOn a connected CID_LOCAL stream with an SK_SKB verdict, a 40-byte readfrom a 100-byte packet made SIOCINQ report -40, an empty recv returnELOOP, and poll report the empty socket readable.  After verdict detach,receiving 40 bytes wrapped the counter to zero and hid those queued bytesuntil one more byte arrived.  The fixed run kept the counter balancedand exposed all queued data immediately.\nThis was found during an LLM-assisted manual source audit of VSOCKreceive accounting while re-evaluating virtio_transport_read_skb() afterCVE-2024-50169.\nSubtract only skb->len minus the VSOCK offset from rx_bytes.  Retain thefull packet length for buf_used and peer credit.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99062https://git.kernel.org/stable/c/e4a0028b0d54b2c45e1dc8c0dd95fe3e9236f55bhttps://git.kernel.org/stable/c/38bad3930b1185dd6c98db3dd342ddc123c6f3efhttps://git.kernel.org/stable/c/dd4b2f88ee517f9629d0d3dbfced02ffbc33e2dchttps://git.kernel.org/stable/c/a463f55c791b96cfd12df8b10ea737d45c80bb18#kernel #Linux#CVE_2026_99062#bot", "url": "https://infosec.exchange/users/cve/statuses/117490667388999916"}, {"timestamp": "2026-10-23T15:31:37Z", "date_only": false, "value": "2026-10-23T15:31:37Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-Q643-38MV-P69J", "record": "GHSA-Q643-38MV-P69J", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T15:31:37Z", "date_only": false, "value": "2026-10-23T15:31:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-Q643-38MV-P69J", "record": "GHSA-Q643-38MV-P69J", "field": "modified"}, {"timestamp": "2026-10-25T01:06:04Z", "date_only": false, "value": "2026-10-25T01:06:04.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99062", "record": "MSRC_CVE-2026-99062", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-25T01:06:04Z", "date_only": false, "value": "2026-10-25T01:06:04.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99062", "record": "MSRC_CVE-2026-99062", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-25T01:06:04Z", "date_only": false, "value": "2026-10-25T01:06:04.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99062", "record": "MSRC_CVE-2026-99062", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-25T07:01:02.657Z", "date_only": false, "value": "2026-10-25T07:01:02.657Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99062", "record": "MSRC_CVE-2026-99062", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-28T06:07:58.448Z", "date_only": false, "value": "2026-10-28T06:07:58.448237Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99062", "record": "BELL-CVE-2026-99062", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T06:31:48.700Z", "date_only": false, "value": "2026-10-28T06:31:48.700846Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99062", "record": "BELL-CVE-2026-99062", "field": "modified"}, {"timestamp": "2026-10-30T19:03:42Z", "date_only": false, "value": "2026-10-30T19:03:42Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99062", "record": "UBUNTU-CVE-2026-99062", "field": "modified"}], "metrics": {"as_of": "2026-11-03T06:33:57.412Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:23:03.360Z", "date_only": false, "value": "2026-10-23T12:23:03.360Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99062", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:23:03.360Z", "date_only": false, "value": "2026-10-23T12:23:03.360Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99062", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 929454.052988, "hours": 258.1816813855556, "days": 10.757570057731481, "min_seconds": 929454.052988, "max_seconds": 929454.052988, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:23:03.360Z", "date_only": false, "value": "2026-10-23T12:23:03.360Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99062", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-03T06:33:57.412Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}