{"metadata": {"vulnerability": "CVE-2026-99184", "count": 22, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 14}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-25T10:25:14.399Z", "date_only": false, "value": "2026-09-25T10:25:14.399Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99184", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T10:35:42.469Z", "date_only": false, "value": "2026-10-28T10:35:42.469Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99184", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T10:35:42.469Z", "date_only": false, "value": "2026-10-28T10:35:42.469Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99184", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-28T10:35:42.469Z", "date_only": false, "value": "2026-10-28T10:35:42.469Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99184", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-28T11:17:00Z", "date_only": false, "value": "2026-10-28T11:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99184", "record": "UBUNTU-CVE-2026-99184", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T11:17:39Z", "date_only": false, "value": "2026-10-28T11:17:39Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FQRQ-QCW6-WMQQ", "record": "GHSA-FQRQ-QCW6-WMQQ", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-28T11:17:39.243Z", "date_only": false, "value": "2026-10-28T11:17:39.243", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99184", "record": "FKIE_CVE-2026-99184", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T11:17:39.243Z", "date_only": false, "value": "2026-10-28T11:17:39.243", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99184", "record": "FKIE_CVE-2026-99184", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-28T11:40:26.012Z", "date_only": false, "value": "2026-10-28T11:40:26.012202Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117518344223126572", "record": "CVE-2026-99184", "field": "creation_timestamp", "uuid": "531a92dd-4f57-4efd-94cc-d896061b97fe", "content": "CVE-2026-99184 accel/rocket: search every core slot when a core is removed In the Linux kernel, the following vulnerability has been resolved:\naccel/rocket: search every core slot when a core is removed\nrocket_remove() decrements rdev->num_cores for each core it removes,while find_core_for_dev() searches slots 0 to num_cores - 1. Unbindingthe cores in the order they were bound therefore loses the last one: bythe time it is removed the search range has already shrunk past itsslot, so find_core_for_dev() returns -1 and rocket_remove() gives upwithout doing anything.\nnum_cores never reaches zero, rocket_device_fini() never runs, and thefile-scoped rdev keeps pointing at a device that is going away. Bindingthe cores again starts from that stale count, because rocket_probe()takes rdev->num_cores as the slot to fill. On an RK3588, which describesthree cores, the second round lands on slots 1, 2 and 3 while rdev->coreswas allocated with room for three:\n  rocket fdab0000.npu: Rockchip NPU core 1 version: 1179210309  rocket fdac0000.npu: Rockchip NPU core 2 version: 1179210309  rocket fdad0000.npu: Rockchip NPU core 3 version: 1179210309\nThe write to rdev->cores[3] is past the end of the array.\nNothing in tree reads the core array often enough to notice, so theoverrun is silent today. It turned up while testing a devfreq series ontop of this, where a worker walks every core a few times a second, andUBSAN caught the first bool it read out of the overrun entry:\n  UBSAN: invalid-load in drivers/accel/rocket/rocket_devfreq.c:47:10  load of value 5 is not a valid value for type '_Bool'  Workqueue: devfreq_wq devfreq_monitor\nRecord how many slots were allocated and search all of them. Every coreis then found on removal, num_cores reaches zero, the device is torn downand a later bind starts from a clean rdev.\nThis does not make unbinding a single core out of several work. probestill takes num_cores as the slot to fill, so rebinding one core whileits siblings stay bound would write over a slot that is already in use,and rocket_open() still reaches for cores[0] whether or not anything isthere. Both of those want more thought than a fix should carry.\nFound by unbinding and rebinding all three cores on an Orange Pi 5 Plus.With this applied, 25 unbind/rebind rounds and 5 module unload/reloadrounds run clean there: the cores land in slots 0, 1 and 2 every time,whichever order they are bound in, and the shared supply goes back to asingle user after each round.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99184https://git.kernel.org/stable/c/5078c91f5c84bb383d0a10ed39856f98575e39cfhttps://git.kernel.org/stable/c/134451cf95cb6aa04b725fbfa04e878d072756f5https://git.kernel.org/stable/c/6eff1d69dae808a1518aee5a58d0853a8db3f1be#kernel #Linux#CVE_2026_99184#bot", "url": "https://infosec.exchange/users/cve/statuses/117518344223126572"}, {"timestamp": "2026-10-28T12:31:07Z", "date_only": false, "value": "2026-10-28T12:31:07Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FQRQ-QCW6-WMQQ", "record": "GHSA-FQRQ-QCW6-WMQQ", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T12:31:07Z", "date_only": false, "value": "2026-10-28T12:31:07Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FQRQ-QCW6-WMQQ", "record": "GHSA-FQRQ-QCW6-WMQQ", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-28T23:00:00Z", "date_only": false, "value": "2026-10-28T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-28T23:00:00Z", "date_only": false, "value": "2026-10-28T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T23:00:00Z", "date_only": false, "value": "2026-10-28T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "vulnerabilities.83.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T06:06:44.553Z", "date_only": false, "value": "2026-10-30T06:06:44.553205Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99184", "record": "BELL-CVE-2026-99184", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T23:00:00Z", "date_only": false, "value": "2026-11-02T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-05T23:00:00Z", "date_only": false, "value": "2026-11-05T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-10T20:02:26.308Z", "date_only": false, "value": "2026-11-10T20:02:26.308513Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99184", "record": "BELL-CVE-2026-99184", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-10T23:00:00Z", "date_only": false, "value": "2026-11-10T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-11-10T23:00:00Z", "date_only": false, "value": "2026-11-10T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-11T01:36:26Z", "date_only": false, "value": "2026-11-11T01:36:26Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99184", "record": "UBUNTU-CVE-2026-99184", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-11T11:32:14.044Z", "date_only": false, "value": "2026-11-11T11:32:14.044+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.generator.date", "linked_record": true}], "metrics": {"as_of": "2026-11-11T18:58:17.825Z", "anchors": {"origin": {"timestamp": "2026-10-28T10:35:42.469Z", "date_only": false, "value": "2026-10-28T10:35:42.469Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99184", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T10:35:42.469Z", "date_only": false, "value": "2026-10-28T10:35:42.469Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99184", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1239755.356301, "hours": 344.3764878613889, "days": 14.349020327557872, "min_seconds": 1239755.356301, "max_seconds": 1239755.356301, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T10:35:42.469Z", "date_only": false, "value": "2026-10-28T10:35:42.469Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99184", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T18:58:17.825Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}