{"metadata": {"vulnerability": "CVE-2026-99109", "count": 21, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 13}}, "data": [{"timestamp": "2026-09-25T10:25:14.391Z", "date_only": false, "value": "2026-09-25T10:25:14.391Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99109", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T10:34:27.507Z", "date_only": false, "value": "2026-10-28T10:34:27.507Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99109", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T10:49:57.234Z", "date_only": false, "value": "2026-10-28T10:49:57.234979Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117518145725540654", "record": "CVE-2026-99109", "field": "creation_timestamp", "uuid": "e0f228f9-7149-404b-adf8-fb665f8300d5", "content": "CVE-2026-99109 smb: client: reject SetEA requests that do not fit the request buffer In the Linux kernel, the following vulnerability has been resolved:\nsmb: client: reject SetEA requests that do not fit the request buffer\nCIFSSMBSetEA() copies the caller's extended attribute value into theSMB request buffer without checking that it fits.  The requirement isstated in the source but was never implemented:\n\t/*BB add length check to see if it would fit in\t     negotiated SMB buffer size BB */\t/* if (ea_value_len > buffer_size - 512 (enough for header)) */\tif (ea_value_len)\t\tmemcpy(parm_data->list.name + name_len + 1,\t\t       ea_value, ea_value_len);\nThe only bound applied on the way in is in cifs_xattr_set():\n\t#define MAX_EA_VALUE_SIZE CIFSMaxBufSize\t...\tif (size > MAX_EA_VALUE_SIZE)\nCIFSMaxBufSize is the full payload capacity of the buffer, so a valueof exactly that size leaves no room for the SMB header, the TRANS2parameter block, the fealist header and the EA name that are writtenahead of it in the same object.\nSendReceive() already enforces the correct limit on this very length:\n\tif (in_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE)\nbut it is called after the copy has taken place.  An unprivilegedsetxattr(2) on an SMB1 mount with a 250-byte name and a 16384-bytevalue writes 16384 bytes starting 345 bytes into a 16588-bytecifs_request object, ending 141 bytes past it:\n  BUG: KASAN: slab-out-of-bounds in CIFSSMBSetEA+0xabc/0xde0  Write of size 16384 at addr ffff888003aa0159 by task init/68   __asan_memcpy+0x3c/0x60   CIFSSMBSetEA+0xabc/0xde0   cifs_xattr_set+0xd3a/0xff0   __vfs_setxattr+0x13e/0x1a0  The buggy address is located 345 bytes inside of   allocated 16588-byte region\nApply SendReceive()'s limit to the assembled request before the copyrather than after it, and widen the byte counters so the sum cannotwrap before it is tested.\nbyte_count is also tested against U16_MAX, because it is stored in the16-bit pSMB->ByteCount.  That becomes reachable when CIFSMaxBufSize israised at module load, where it may be set as high as 1024*127: with a5-byte EA name and a 65521-byte value, count is exactly U16_MAX whilebyte_count is 65556, and cpu_to_le16() would truncate it to 20 andtransmit a frame whose ByteCount does not match its length.  Testingbyte_count covers count as well, since byte_count is the larger of thetwo and count's only 16-bit consumer is written after this point.\ncheck_add_overflow() is evaluated first so that total_len is assignedbefore it is reported.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99109https://git.kernel.org/stable/c/9efbd764ab80fa86d2258550877a74d78a25e855https://git.kernel.org/stable/c/4aa2c106aef4bf3dfd97c30842db0767b26e8428#kernel #Linux#CVE_2026_99109#bot", "url": "https://infosec.exchange/users/cve/statuses/117518145725540654"}, {"timestamp": "2026-10-28T11:17:00Z", "date_only": false, "value": "2026-10-28T11:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99109", "record": "UBUNTU-CVE-2026-99109", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T11:17:30Z", "date_only": false, "value": "2026-10-28T11:17:30Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-WH32-MMF9-9F7G", "record": "GHSA-WH32-MMF9-9F7G", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-28T11:17:30.287Z", "date_only": false, "value": "2026-10-28T11:17:30.287", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99109", "record": "FKIE_CVE-2026-99109", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T12:31:02Z", "date_only": false, "value": "2026-10-28T12:31:02Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-WH32-MMF9-9F7G", "record": "GHSA-WH32-MMF9-9F7G", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T01:03:31Z", "date_only": false, "value": "2026-10-29T01:03:31.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99109", "record": "MSRC_CVE-2026-99109", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-29T01:03:31Z", "date_only": false, "value": "2026-10-29T01:03:31.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99109", "record": "MSRC_CVE-2026-99109", "field": "vulnerabilities.0.remediations.0.date", "linked_record": true}, {"timestamp": "2026-10-29T01:03:31Z", "date_only": false, "value": "2026-10-29T01:03:31.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99109", "record": "MSRC_CVE-2026-99109", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:06:42.753Z", "date_only": false, "value": "2026-10-30T06:06:42.753369Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99109", "record": "BELL-CVE-2026-99109", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:35:36.296Z", "date_only": false, "value": "2026-10-30T06:35:36.29669Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99109", "record": "BELL-CVE-2026-99109", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-01T14:47:14Z", "date_only": false, "value": "2026-11-01T14:47:14.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99109", "record": "MSRC_CVE-2026-99109", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-05T14:52:42Z", "date_only": false, "value": "2026-11-05T14:52:42.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99109", "record": "MSRC_CVE-2026-99109", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-05T14:52:42Z", "date_only": false, "value": "2026-11-05T14:52:42.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99109", "record": "MSRC_CVE-2026-99109", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-06T08:02:51.313Z", "date_only": false, "value": "2026-11-06T08:02:51.313Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99109", "record": "MSRC_CVE-2026-99109", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-06T10:51:53Z", "date_only": false, "value": "2026-11-06T10:51:53Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99109", "record": "UBUNTU-CVE-2026-99109", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-06T17:15:07.205Z", "date_only": false, "value": "2026-11-06T17:15:07.205Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99109", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-06T17:15:07.205Z", "date_only": false, "value": "2026-11-06T17:15:07.205Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99109", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-06T18:18:31.847Z", "date_only": false, "value": "2026-11-06T18:18:31.847", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99109", "record": "FKIE_CVE-2026-99109", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-06T18:34:57Z", "date_only": false, "value": "2026-11-06T18:34:57Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-WH32-MMF9-9F7G", "record": "GHSA-WH32-MMF9-9F7G", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-08T08:18:46.293Z", "anchors": {"origin": {"timestamp": "2026-10-28T10:34:27.507Z", "date_only": false, "value": "2026-10-28T10:34:27.507Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99109", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T10:34:27.507Z", "date_only": false, "value": "2026-10-28T10:34:27.507Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99109", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 942258.786336, "hours": 261.73855176, "days": 10.90577299, "min_seconds": 942258.786336, "max_seconds": 942258.786336, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T10:34:27.507Z", "date_only": false, "value": "2026-10-28T10:34:27.507Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99109", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-08T08:18:46.293Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}