{"metadata": {"vulnerability": "CVE-2026-99108", "count": 15, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-25T10:25:14.391Z", "date_only": false, "value": "2026-09-25T10:25:14.391Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99108", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T10:34:26.772Z", "date_only": false, "value": "2026-10-28T10:34:26.772Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99108", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T10:34:26.772Z", "date_only": false, "value": "2026-10-28T10:34:26.772Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99108", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-28T10:34:26.772Z", "date_only": false, "value": "2026-10-28T10:34:26.772Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99108", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-28T10:49:16.698Z", "date_only": false, "value": "2026-10-28T10:49:16.698757Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117518143065926152", "record": "CVE-2026-99108", "field": "creation_timestamp", "uuid": "f28fe5c5-ce6d-4695-acd5-0894365607bb", "content": "CVE-2026-99108 ntfs: fix FITRIM range alignment In the Linux kernel, the following vulnerability has been resolved:\nntfs: fix FITRIM range alignment\nntfs_trim_fs() aligns the start of a free extent up to the device discardgranularity, but derives the discard length by aligning the original extentlength down. When the free extent start is not discard-aligned, adding thatlength to the aligned start can extend the discard past the free extent andinto allocated clusters.\nFor example, with 4 KiB clusters and 32 KiB discard granularity, the freeextent [4 KiB, 36 KiB) becomes the discard range [32 KiB, 64 KiB), so28 KiB beyond the free extent may be discarded.\nAlign the absolute end of the free extent down and derive the length fromthe two aligned endpoints. Skip extents that contain no full discard unit.\nReproduced with a 4 KiB-cluster NTFS filesystem on scsi_debug configuredfor 32 KiB discard granularity and read-zero-after-trim. Before thischange, FITRIM zeroed seven allocated 4 KiB clusters following an unaligned32 KiB hole. With this change, the same data remains intact across FITRIMand remount.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99108https://git.kernel.org/stable/c/5e87da8ba8d3d647d89c754912e45c1f1a3bfc2ehttps://git.kernel.org/stable/c/03c6ecc4b4b13a3901f207152451fdd2d82e40c4#kernel #Linux#CVE_2026_99108#bot", "url": "https://infosec.exchange/users/cve/statuses/117518143065926152"}, {"timestamp": "2026-10-28T11:17:00Z", "date_only": false, "value": "2026-10-28T11:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99108", "record": "UBUNTU-CVE-2026-99108", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T11:17:30Z", "date_only": false, "value": "2026-10-28T11:17:30Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-8QCR-MMV6-JJC8", "record": "GHSA-8QCR-MMV6-JJC8", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-28T11:17:30.177Z", "date_only": false, "value": "2026-10-28T11:17:30.177", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99108", "record": "FKIE_CVE-2026-99108", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T11:17:30.177Z", "date_only": false, "value": "2026-10-28T11:17:30.177", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99108", "record": "FKIE_CVE-2026-99108", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-28T12:31:02Z", "date_only": false, "value": "2026-10-28T12:31:02Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8QCR-MMV6-JJC8", "record": "GHSA-8QCR-MMV6-JJC8", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T12:31:02Z", "date_only": false, "value": "2026-10-28T12:31:02Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8QCR-MMV6-JJC8", "record": "GHSA-8QCR-MMV6-JJC8", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T06:06:42.691Z", "date_only": false, "value": "2026-10-30T06:06:42.691604Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99108", "record": "BELL-CVE-2026-99108", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:35:35.961Z", "date_only": false, "value": "2026-10-30T06:35:35.961133Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99108", "record": "BELL-CVE-2026-99108", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T06:35:35.961Z", "date_only": false, "value": "2026-10-30T06:35:35.961133Z", "kind": "other", "label": "Withdrawn", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99108", "record": "BELL-CVE-2026-99108", "field": "withdrawn", "linked_record": true}, {"timestamp": "2026-11-05T04:42:02Z", "date_only": false, "value": "2026-11-05T04:42:02Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99108", "record": "UBUNTU-CVE-2026-99108", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-07T07:44:21.009Z", "anchors": {"origin": {"timestamp": "2026-10-28T10:34:26.772Z", "date_only": false, "value": "2026-10-28T10:34:26.772Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99108", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T10:34:26.772Z", "date_only": false, "value": "2026-10-28T10:34:26.772Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99108", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 853794.237365, "hours": 237.1650659347222, "days": 9.881877747280091, "min_seconds": 853794.237365, "max_seconds": 853794.237365, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T10:34:26.772Z", "date_only": false, "value": "2026-10-28T10:34:26.772Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99108", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-07T07:44:21.009Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}