{"metadata": {"vulnerability": "CVE-2026-99207", "count": 15, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-25T10:25:14.401Z", "date_only": false, "value": "2026-09-25T10:25:14.401Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99207", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99207", "record": "UBUNTU-CVE-2026-99207", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T10:36:00.728Z", "date_only": false, "value": "2026-10-28T10:36:00.728Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99207", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T10:36:00.728Z", "date_only": false, "value": "2026-10-28T10:36:00.728Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99207", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-28T10:36:00.728Z", "date_only": false, "value": "2026-10-28T10:36:00.728Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99207", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-28T11:17:42Z", "date_only": false, "value": "2026-10-28T11:17:42Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7J96-Q76X-X86V", "record": "GHSA-7J96-Q76X-X86V", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-28T11:17:42.033Z", "date_only": false, "value": "2026-10-28T11:17:42.033", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99207", "record": "FKIE_CVE-2026-99207", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T11:17:42.033Z", "date_only": false, "value": "2026-10-28T11:17:42.033", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99207", "record": "FKIE_CVE-2026-99207", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-28T11:55:54.776Z", "date_only": false, "value": "2026-10-28T11:55:54.776542Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117518405086450815", "record": "CVE-2026-99207", "field": "creation_timestamp", "uuid": "314c8f56-ff25-4b9f-821c-5904d98f104e", "content": "CVE-2026-99207 scsi: target: Disable interrupts while holding delayed_cmd_lock In the Linux kernel, the following vulnerability has been resolved:\nscsi: target: Disable interrupts while holding delayed_cmd_lock\ntarget_do_delayed_work() takes dev->delayed_cmd_lock with a plainspin_lock(). It runs from system_percpu_wq, so interrupts stay enabledwhile the lock is held. Every other acquisition of that lock usesspin_lock_irqsave(): target_handle_task_attr() andtransport_complete_ordered_sync() in target_core_transport.c, andtarget_non_ordered_release() in target_core_device.c.\nThat was safe while every caller of transport_complete_task_attr() ranin process context: target_complete_ok_work() from target_completion_wq,transport_complete_qf() from dev->qf_work_queue, andtransport_generic_request_failure() from the submit and execute paths.\nSince commit 06933066d88a (\"scsi: target: Add support for completingcommands from backend context\") that is no longer true. Withcomplete_type=1 on a fabric that sets direct_compl_supp,target_complete() runs target_complete_ok_work() inline in the backend'scompletion context, which target_complete_cmd_with_sense() documents as\"May be called from interrupt context\". For iblock that is the bioend_io.\ntarget_complete_ok_work() starts with transport_complete_task_attr(),which takes delayed_cmd_lock in two ways:\n - Every ORDERED command is put on dev->delayed_cmd_list by   target_handle_task_attr() and dispatched from there by   target_do_delayed_work(), which marks it SCF_TASK_ORDERED_SYNC.  Its   completion therefore goes through transport_complete_ordered_sync().\n - A SIMPLE command that completes while an ORDERED command is pending   drops the last reference to the killed dev->non_ordered, and   percpu_ref_put() then runs target_non_ordered_release() in the   completing context.\nBoth take the lock and, if commands are waiting, callschedule_work(&dev->delayed_cmd_work), which queues on system_percpu_wq,i.e. on the CPU that took the completion. Further completions for thesame queue are typically delivered there too, so one arriving while thework holds the lock spins on it forever.\nReaching this needs complete_type=1, which is not the default(vhost-scsi, the only fabric with direct_compl_supp, defaults toTARGET_QUEUE_COMPL), a backend whose I/O completes from interruptcontext, and ORDERED commands from the initiator. Linux virtio_scsiguests send only VIRTIO_SCSI_S_SIMPLE and never take the ordered path;any guest that uses the ORDERED task attribute, which vhost-scsiaccepts, does.\ntarget_do_delayed_work() is a work item and always runs in processcontext, so spin_lock_irq() is sufficient.\nFound by inspection; no runtime report. A single ORDERED command goesthrough both acquisitions, so with CONFIG_PROVE_LOCKING the first onecompleted through direct completion should produce an inconsistent lockstate report on delayed_cmd_lock (hardirq or softirq, depending on wherethe backend completes).\nhttps://www.cve.org/CVERecord?id=CVE-2026-99207https://git.kernel.org/stable/c/7563650522732041ccfb2e4593878b5ea98d498chttps://git.kernel.org/stable/c/04a67a8b1a4460345d22fe75d93430cbf7e651d7#kernel #Linux#CVE_2026_99207#bot", "url": "https://infosec.exchange/users/cve/statuses/117518405086450815"}, {"timestamp": "2026-10-28T12:31:08Z", "date_only": false, "value": "2026-10-28T12:31:08Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7J96-Q76X-X86V", "record": "GHSA-7J96-Q76X-X86V", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T12:31:08Z", "date_only": false, "value": "2026-10-28T12:31:08Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7J96-Q76X-X86V", "record": "GHSA-7J96-Q76X-X86V", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T00:15:03Z", "date_only": false, "value": "2026-10-30T00:15:03Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99207", "record": "UBUNTU-CVE-2026-99207", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T06:06:45.117Z", "date_only": false, "value": "2026-10-30T06:06:45.117028Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99207", "record": "BELL-CVE-2026-99207", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:35:42.743Z", "date_only": false, "value": "2026-10-30T06:35:42.743590Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99207", "record": "BELL-CVE-2026-99207", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T06:35:42.743Z", "date_only": false, "value": "2026-10-30T06:35:42.743590Z", "kind": "other", "label": "Withdrawn", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99207", "record": "BELL-CVE-2026-99207", "field": "withdrawn", "linked_record": true}], "metrics": {"as_of": "2026-11-04T04:39:17.633Z", "anchors": {"origin": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99207", "record": "UBUNTU-CVE-2026-99207", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99207", "record": "UBUNTU-CVE-2026-99207", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 621557.633934, "hours": 172.65489831500003, "days": 7.1939540964583335, "min_seconds": 535157.633934, "max_seconds": 621557.633934, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99207", "record": "UBUNTU-CVE-2026-99207", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-04T04:39:17.633Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}