{"metadata": {"vulnerability": "CVE-2026-99154", "count": 19, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-09-25T10:25:14.397Z", "date_only": false, "value": "2026-09-25T10:25:14.397Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99154", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99154", "record": "UBUNTU-CVE-2026-99154", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T10:35:08.968Z", "date_only": false, "value": "2026-10-28T10:35:08.968Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99154", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T11:17:35Z", "date_only": false, "value": "2026-10-28T11:17:35Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-X6PH-VJQM-9Q4F", "record": "GHSA-X6PH-VJQM-9Q4F", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-28T11:17:35.577Z", "date_only": false, "value": "2026-10-28T11:17:35.577", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99154", "record": "FKIE_CVE-2026-99154", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T11:20:13.904Z", "date_only": false, "value": "2026-10-28T11:20:13.904086Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117518264786761597", "record": "CVE-2026-99154", "field": "creation_timestamp", "uuid": "8f34506e-631d-4c2a-aa76-5e9ab17fc9f5", "content": "CVE-2026-99154 scsi: libiscsi: Reject a negative task index from parse_pdu_itt In the Linux kernel, the following vulnerability has been resolved:\nscsi: libiscsi: Reject a negative task index from parse_pdu_itt\nA transport that implements parse_pdu_itt hands libiscsi an index takenfrom the PDU, and both lookups bound it from above only:\n      if (i >= session->cmds_max)\ni and cmds_max are both int, so a negative index passes andsession->cmds[i] is read from before the array.\nbe2iscsi produces one. beiscsi_parse_pdu() assigns the raw tag,\n      *index = (int)itt;\nand beiscsi_complete_pdu() forwards an unsolicited NOP-In from thehardware async ring without replacing its ITT, so the value is thetarget's. It also reports the session's own age rather than the one inthe tag, which leaves the age comparison in iscsi_verify_itt() withnothing to reject.\nBound the index from below in both lookups.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99154https://git.kernel.org/stable/c/6cadfa6f1f5896632d4223d3b7addb2a29fea74ehttps://git.kernel.org/stable/c/35b60549a956237488c89a2d85352e026e7d55b7https://git.kernel.org/stable/c/8ee2a09a1dbb257c9e828ad2497f8e4832dfb142#kernel #Linux#CVE_2026_99154#bot", "url": "https://infosec.exchange/users/cve/statuses/117518264786761597"}, {"timestamp": "2026-10-28T12:31:05Z", "date_only": false, "value": "2026-10-28T12:31:05Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-X6PH-VJQM-9Q4F", "record": "GHSA-X6PH-VJQM-9Q4F", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T01:06:13Z", "date_only": false, "value": "2026-10-29T01:06:13.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99154", "record": "MSRC_CVE-2026-99154", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-29T01:06:13Z", "date_only": false, "value": "2026-10-29T01:06:13.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99154", "record": "MSRC_CVE-2026-99154", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-10-29T01:06:13Z", "date_only": false, "value": "2026-10-29T01:06:13.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99154", "record": "MSRC_CVE-2026-99154", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T01:06:13Z", "date_only": false, "value": "2026-10-29T01:06:13.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99154", "record": "MSRC_CVE-2026-99154", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-29T07:00:29.390Z", "date_only": false, "value": "2026-10-29T07:00:29.390Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99154", "record": "MSRC_CVE-2026-99154", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-30T06:08:46.912Z", "date_only": false, "value": "2026-10-30T06:08:46.912241Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99154", "record": "BELL-CVE-2026-99154", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T06:35:39.135Z", "date_only": false, "value": "2026-10-30T06:35:39.135617Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99154", "record": "BELL-CVE-2026-99154", "field": "modified"}, {"timestamp": "2026-10-30T19:03:58Z", "date_only": false, "value": "2026-10-30T19:03:58Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99154", "record": "UBUNTU-CVE-2026-99154", "field": "modified"}, {"timestamp": "2026-10-31T12:44:09.854Z", "date_only": false, "value": "2026-10-31T12:44:09.854Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99154", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-31T12:44:09.854Z", "date_only": false, "value": "2026-10-31T12:44:09.854Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99154", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-31T13:17:57.807Z", "date_only": false, "value": "2026-10-31T13:17:57.807", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99154", "record": "FKIE_CVE-2026-99154", "field": "lastModified"}, {"timestamp": "2026-10-31T15:30:22Z", "date_only": false, "value": "2026-10-31T15:30:22Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-X6PH-VJQM-9Q4F", "record": "GHSA-X6PH-VJQM-9Q4F", "field": "modified"}], "metrics": {"as_of": "2026-11-02T04:59:21.783Z", "anchors": {"origin": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99154", "record": "UBUNTU-CVE-2026-99154", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99154", "record": "UBUNTU-CVE-2026-99154", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 449961.783759, "hours": 124.9893843775, "days": 5.2078910157291665, "min_seconds": 363561.783759, "max_seconds": 449961.783759, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99154", "record": "UBUNTU-CVE-2026-99154", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-02T04:59:21.783Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}