{"metadata": {"vulnerability": "CVE-2026-99127", "count": 33, "kinds": {"milestone": 10, "sighting": 1, "kev": 0, "other": 22}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-25T10:25:14.394Z", "date_only": false, "value": "2026-09-25T10:25:14.394Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99127", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T10:34:41.448Z", "date_only": false, "value": "2026-10-28T10:34:41.448Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99127", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T11:02:03.462Z", "date_only": false, "value": "2026-10-28T11:02:03.462539Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117518193321957357", "record": "CVE-2026-99127", "field": "creation_timestamp", "uuid": "b76f9590-8879-4037-976e-0ee6ed5d2936", "content": "CVE-2026-99127 page_pool: keep frag_offset aligned for odd-sized requests In the Linux kernel, the following vulnerability has been resolved:\npage_pool: keep frag_offset aligned for odd-sized requests\npage_pool_alloc_frag_netmem() rounds the requested fragment size with\n\tsize = ALIGN(size, dma_get_cache_alignment());\ndma_get_cache_alignment() returns 1 unless the architecture definesARCH_DMA_MINALIGN, which DMA-coherent architectures such as x86 do not.There the ALIGN() is a no-op and pool->frag_offset advances by the raw,unrounded size.\nA single caller asking for an odd size then leaves frag_offset misalignedfor every fragment carved out of that page afterwards.  The pool is shared,so the damage is not confined to the caller that caused it.\nThe per-cpu system_page_pool used by generic XDP hits this.skb_pp_cow_data() allocates its fragments with the raw packet length:\n\tsize = min_t(u32, len, PAGE_SIZE);\ttruesize = size;\tpage = page_pool_dev_alloc(pool, &page_off, &truesize);\nleaving frag_offset odd for whatever is carved out of that page next.  Itsown head allocation is already aligned -- SKB_HEAD_ALIGN(size) plus theXDP_PACKET_HEADROOM its callers pass -- so it is a later user of the sharedpool that pays: page_pool_dev_alloc_va() returns a misaligned buffer,napi_build_skb() installs it as skb->head, and skb_shinfo(skb) ==skb->head + skb->end is misaligned with it.\nskb_shinfo()->dataref is a 4-byte atomic_t at offset 0x20, so theatomic_inc() in __skb_clone() straddles a cache line.  On x86 with splitlock detection -- fatal for kernel split locks by default -- this panicsthe machine:\n  Oops: Split lock detected  RIP: 0010:skb_clone+0x154/0x1e0  Call Trace:   <IRQ>   raw_local_deliver+0x1ed/0x2c0   ip_protocol_deliver_rcu+0x54/0x1c0   ip_local_deliver_finish+0x85/0x100   ip_local_deliver+0x67/0x100   __netif_receive_skb_one_core+0x85/0xa0   process_backlog+0x87/0x130\nReproduced by attaching any generic-mode XDP program to loopback andopening a RAW IPPROTO_UDP socket, which makes raw_local_deliver() cloneevery locally delivered UDP packet; ordinary DNS traffic then triggers it,roughly once per 2500 clones.  Observed on 6.12.101 and 7.1.8.\nTracing page_pool_alloc_frag_netmem() over one such run shows theamplification -- two odd-sized requests, nine misaligned offsets:\n  requested size & 7:   0: 17035    5: 1    7: 1  frag_offset & 7:      0: 17028    3: 1    4: 1    5: 1    6: 1    7: 5\nand skb_pp_cow_data() returning heads that were aligned on entry:\n  head 0xffff8f4c86aeac00 -> 0xffff8f4c53a9a9c4 (&7=4)  head 0xffff8f4d6a8a42c0 -> 0xffff8f4c4f7b7a45 (&7=5)\nRound the fragment size up to at least the alignment struct skb_shared_inforequires, so fragments are always suitably aligned for the objects callersbuild on them.  Architectures needing a larger DMA alignment keep it.\nThis also makes the remainder computed in page_pool_alloc_netmem(),\n\t*size = max_size - *offset;\naligned, since max_size is a power of two -- which fixes the matchingmisalignment of skb->end.\nVerified with a controlled A/B under QEMU/KVM: same tree, same config,same compiler, same rootfs and identical traffic, differing only by thispatch.  A SEC(\"xdp.frags\") XDP_PASS program on lo plus UDP datagramslarger than max_head_size drives skb_pp_cow_data()'s fragment loop, whichpasses raw packet lengths to the pool.  Measured at the return ofskb_pp_cow_data():\n                          unpatched   patched  skb_pp_cow_data calls       40800     40800  misaligned skb->head         1120         0  dataref at line offset >60     80         0\nThe last row counts the accesses that actually fault:skb_shinfo()->dataref sits at head+end+0x20 and is a 4-byte atomic, so`lock incl` splits a 64-byte cache line only when that address lands atoffset 61..63.  All 80 occurrences were at offset 61; the panic reportedabove was at offset 62.  Eliminating the misalignment removes every oneof them.\nSame class of bug as commit 3bed3cc4156e (\"net: Do not allocate pagefragments t---truncated---\nhttps://www.cve.org/CVERecord?id=CVE-2026-99127https://git.kernel.org/stable/c/813a72beaa5d3f4bb135e0def9b3f07a3511ca0ehttps://git.kernel.org/stable/c/dca1b51693c81eaf77e50980be373e01ae857394https://git.kernel.org/stable/c/dc0df5a0c62ccea1d0e08d39a4dc9064de81d411#kernel #Linux#CVE_2026_99127#bot", "url": "https://infosec.exchange/users/cve/statuses/117518193321957357"}, {"timestamp": "2026-10-28T11:17:00Z", "date_only": false, "value": "2026-10-28T11:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99127", "record": "UBUNTU-CVE-2026-99127", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T11:17:32Z", "date_only": false, "value": "2026-10-28T11:17:32Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-4J2X-R727-JFQ6", "record": "GHSA-4J2X-R727-JFQ6", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-28T11:17:32.430Z", "date_only": false, "value": "2026-10-28T11:17:32.430", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99127", "record": "FKIE_CVE-2026-99127", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T12:31:04Z", "date_only": false, "value": "2026-10-28T12:31:04Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4J2X-R727-JFQ6", "record": "GHSA-4J2X-R727-JFQ6", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T23:00:00Z", "date_only": false, "value": "2026-10-28T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-28T23:00:00Z", "date_only": false, "value": "2026-10-28T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T23:00:00Z", "date_only": false, "value": "2026-10-28T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "vulnerabilities.26.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T01:04:38Z", "date_only": false, "value": "2026-10-29T01:04:38.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99127", "record": "MSRC_CVE-2026-99127", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-29T01:04:38Z", "date_only": false, "value": "2026-10-29T01:04:38.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99127", "record": "MSRC_CVE-2026-99127", "field": "vulnerabilities.0.remediations.0.date", "linked_record": true}, {"timestamp": "2026-10-29T01:04:38Z", "date_only": false, "value": "2026-10-29T01:04:38.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99127", "record": "MSRC_CVE-2026-99127", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T01:04:38Z", "date_only": false, "value": "2026-10-29T01:04:38.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99127", "record": "MSRC_CVE-2026-99127", "field": "vulnerabilities.0.remediations.1.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:06:43.625Z", "date_only": false, "value": "2026-10-30T06:06:43.625299Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99127", "record": "BELL-CVE-2026-99127", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T12:42:01.046Z", "date_only": false, "value": "2026-10-30T12:42:01.046Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99127", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T12:42:01.046Z", "date_only": false, "value": "2026-10-30T12:42:01.046Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99127", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T13:21:46.867Z", "date_only": false, "value": "2026-10-30T13:21:46.867", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99127", "record": "FKIE_CVE-2026-99127", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-30T15:34:22Z", "date_only": false, "value": "2026-10-30T15:34:22Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4J2X-R727-JFQ6", "record": "GHSA-4J2X-R727-JFQ6", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-01T14:49:08Z", "date_only": false, "value": "2026-11-01T14:49:08.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99127", "record": "MSRC_CVE-2026-99127", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-02T00:00:00Z", "date_only": true, "value": "2026-11-02", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1473", "record": "CERTFR-2026-AVI-1473", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-11-02T23:00:00Z", "date_only": false, "value": "2026-11-02T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-03T20:04:12.593Z", "date_only": false, "value": "2026-11-03T20:04:12.593509Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99127", "record": "BELL-CVE-2026-99127", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T14:53:57Z", "date_only": false, "value": "2026-11-05T14:53:57.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99127", "record": "MSRC_CVE-2026-99127", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-05T14:53:57Z", "date_only": false, "value": "2026-11-05T14:53:57.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99127", "record": "MSRC_CVE-2026-99127", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-05T23:00:00Z", "date_only": false, "value": "2026-11-05T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-05T23:00:00Z", "date_only": false, "value": "2026-11-05T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-06T00:00:00Z", "date_only": false, "value": "2026-11-06T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1473", "record": "CERTFR-2026-AVI-1473", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-11-06T00:00:00Z", "date_only": false, "value": "2026-11-06T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1473", "record": "CERTFR-2026-AVI-1473", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-06T00:00:00Z", "date_only": false, "value": "2026-11-06T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1473", "record": "CERTFR-2026-AVI-1473", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-11-06T08:02:51.313Z", "date_only": false, "value": "2026-11-06T08:02:51.313Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99127", "record": "MSRC_CVE-2026-99127", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-06T10:57:22.871Z", "date_only": false, "value": "2026-11-06T10:57:22.871+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-09T23:58:44Z", "date_only": false, "value": "2026-11-09T23:58:44Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99127", "record": "UBUNTU-CVE-2026-99127", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-10T23:11:33.867Z", "anchors": {"origin": {"timestamp": "2026-10-28T10:34:41.448Z", "date_only": false, "value": "2026-10-28T10:34:41.448Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99127", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T10:34:41.448Z", "date_only": false, "value": "2026-10-28T10:34:41.448Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99127", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": {"timestamp": "2026-10-29T01:04:38Z", "date_only": false, "value": "2026-10-29T01:04:38.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99127", "record": "MSRC_CVE-2026-99127", "field": "vulnerabilities.0.remediations.1.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": false, "missing": ["start"]}, "disclosure_to_patch": {"available": true, "seconds": 52196.552, "hours": 14.499042222222224, "days": 0.6041267592592593, "min_seconds": 52196.552, "max_seconds": 52196.552, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T10:34:41.448Z", "date_only": false, "value": "2026-10-28T10:34:41.448Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99127", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T01:04:38Z", "date_only": false, "value": "2026-10-29T01:04:38.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99127", "record": "MSRC_CVE-2026-99127", "field": "vulnerabilities.0.remediations.1.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "time_unpatched": {"available": true, "seconds": 52196.552, "hours": 14.499042222222224, "days": 0.6041267592592593, "min_seconds": 52196.552, "max_seconds": 52196.552, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T10:34:41.448Z", "date_only": false, "value": "2026-10-28T10:34:41.448Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99127", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T01:04:38Z", "date_only": false, "value": "2026-10-29T01:04:38.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99127", "record": "MSRC_CVE-2026-99127", "field": "vulnerabilities.0.remediations.1.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}