{"metadata": {"vulnerability": "CVE-2026-99091", "count": 14, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-09-25T10:25:14.390Z", "date_only": false, "value": "2026-09-25T10:25:14.390Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99091", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-26T14:52:00.262Z", "date_only": false, "value": "2026-10-26T14:52:00.262Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99091", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-26T15:16:00Z", "date_only": false, "value": "2026-10-26T15:16:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99091", "record": "UBUNTU-CVE-2026-99091", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-26T15:16:47Z", "date_only": false, "value": "2026-10-26T15:16:47Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-75M9-VH6C-66MX", "record": "GHSA-75M9-VH6C-66MX", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-26T15:16:47.960Z", "date_only": false, "value": "2026-10-26T15:16:47.960", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99091", "record": "FKIE_CVE-2026-99091", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-26T15:21:42.040Z", "date_only": false, "value": "2026-10-26T15:21:42.040267Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117507889652506909", "record": "CVE-2026-99091", "field": "creation_timestamp", "uuid": "872df219-a6e6-4d99-a082-76e71ff413b6", "content": "CVE-2026-99091 Bluetooth: MGMT: Fix status of pending commands flushed on power off In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: MGMT: Fix status of pending commands flushed on power off\ncmd_complete_rsp() receives a struct cmd_lookup and, for a pendingcommand that has no cmd_complete callback, falls through tocmd_status_rsp(cmd, data). cmd_status_rsp() reads data as a u8 *, sothe status sent comes from the first byte of match->sk'srepresentation, not from match->mgmt_status.\ncommit f53e1c9c726d (\"Bluetooth: MGMT: Fix possible crash onmgmt_index_removed\") changed the callers' data from &status to &matchand updated the cmd_complete branch to match->mgmt_status, but leftthe fall-through passing data unchanged.\nIn mgmt_index_removed() match->sk is NULL, so every such command isanswered with status 0x00 (Success) instead ofMGMT_STATUS_INVALID_INDEX. In __mgmt_power_off() it is NULL too,unless a Set Powered command was pending: then settings_rsp() hasstored that command's socket in match->sk, and the byte sent comesfrom the socket pointer. Either way the status the caller set,MGMT_STATUS_NOT_POWERED (or MGMT_STATUS_INVALID_INDEX when the deviceis being unregistered), is lost.\nPass the status the callers set.\nThis was seen on a QCA9377 laptop: bluetoothd's Start Discovery,pending when the adapter was powered off, was answered with CommandStatus 0x00 and no parameters, and bluetoothd 5.72 crashed on thezero-length success. BlueZ master has since added the length checkon that path (\"adapter: Fix crash on short start discovery reply\",BlueZ a734b06059cb), but userspace should still be told Not Powered,not Success.\nTested on Ubuntu 7.0.0-31 with a virtual controller (hci_vhci):power off is held in HCI Write Scan Enable while a Start Discovery issubmitted, and the flush answers it with status 0x00 before thischange and 0x0f (Not Powered) after.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99091https://git.kernel.org/stable/c/44ce36c5789ac84e65de1e98c32db9a5ac04ed47https://git.kernel.org/stable/c/7ed7e038b520cf0dfa12d61c2caddb95e2f6922dhttps://git.kernel.org/stable/c/ec227cddd13cd7ac9077d263a73473ac370a055dhttps://git.kernel.org/stable/c/07976405a3c71253e50533ee7b7a8b0dc16ab6bahttps://git.kernel.org/stable/c/86ef0f58bdecdedb3a1240971c56d71b7e4ce3fc#kernel #Linux#CVE_2026_99091#bot", "url": "https://infosec.exchange/users/cve/statuses/117507889652506909"}, {"timestamp": "2026-10-26T15:34:50Z", "date_only": false, "value": "2026-10-26T15:34:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-75M9-VH6C-66MX", "record": "GHSA-75M9-VH6C-66MX", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T06:07:35.744Z", "date_only": false, "value": "2026-10-29T06:07:35.744274Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99091", "record": "BELL-CVE-2026-99091", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T06:34:53.307Z", "date_only": false, "value": "2026-10-29T06:34:53.307550Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99091", "record": "BELL-CVE-2026-99091", "field": "modified"}, {"timestamp": "2026-10-30T12:41:41.779Z", "date_only": false, "value": "2026-10-30T12:41:41.779Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99091", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T12:41:41.779Z", "date_only": false, "value": "2026-10-30T12:41:41.779Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99091", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T13:21:44.810Z", "date_only": false, "value": "2026-10-30T13:21:44.810", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99091", "record": "FKIE_CVE-2026-99091", "field": "lastModified"}, {"timestamp": "2026-10-30T15:34:18Z", "date_only": false, "value": "2026-10-30T15:34:18Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-75M9-VH6C-66MX", "record": "GHSA-75M9-VH6C-66MX", "field": "modified"}, {"timestamp": "2026-10-30T19:03:47Z", "date_only": false, "value": "2026-10-30T19:03:47Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99091", "record": "UBUNTU-CVE-2026-99091", "field": "modified"}], "metrics": {"as_of": "2026-10-31T19:39:08.725Z", "anchors": {"origin": {"timestamp": "2026-10-26T14:52:00.262Z", "date_only": false, "value": "2026-10-26T14:52:00.262Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99091", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-26T14:52:00.262Z", "date_only": false, "value": "2026-10-26T14:52:00.262Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99091", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 449228.463294, "hours": 124.78568424833334, "days": 5.1994035103472225, "min_seconds": 449228.463294, "max_seconds": 449228.463294, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-26T14:52:00.262Z", "date_only": false, "value": "2026-10-26T14:52:00.262Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99091", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-31T19:39:08.725Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}