{"metadata": {"vulnerability": "CVE-2026-99208", "count": 14, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-09-25T10:25:14.401Z", "date_only": false, "value": "2026-09-25T10:25:14.401Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99208", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99208", "record": "UBUNTU-CVE-2026-99208", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T10:36:01.473Z", "date_only": false, "value": "2026-10-28T10:36:01.473Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99208", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T10:36:01.473Z", "date_only": false, "value": "2026-10-28T10:36:01.473Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99208", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-28T10:36:01.473Z", "date_only": false, "value": "2026-10-28T10:36:01.473Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99208", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-28T11:17:42Z", "date_only": false, "value": "2026-10-28T11:17:42Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J8G3-C5F3-W4QH", "record": "GHSA-J8G3-C5F3-W4QH", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-28T11:17:42.170Z", "date_only": false, "value": "2026-10-28T11:17:42.170", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99208", "record": "FKIE_CVE-2026-99208", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T11:17:42.170Z", "date_only": false, "value": "2026-10-28T11:17:42.170", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99208", "record": "FKIE_CVE-2026-99208", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-28T11:56:35.081Z", "date_only": false, "value": "2026-10-28T11:56:35.081200Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117518407727407982", "record": "CVE-2026-99208", "field": "creation_timestamp", "uuid": "6e92565f-8901-4ef1-b514-41f8366ca494", "content": "CVE-2026-99208 drm/xe/oa: Zero OA buffer at allocation In the Linux kernel, the following vulnerability has been resolved:\ndrm/xe/oa: Zero OA buffer at allocation\nttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation andmay contain data from previously freed pages. Since the OA buffer ismmap'able by userspace, this can expose stale kernel memory contents.\nStreams opened with DRM_XE_OA_PROPERTY_OA_DISABLED allocate the OAbuffer without calling xe_oa_init_oa_buffer(). Zero the buffer atallocation to prevent information disclosure through mmap.\nThe existing zeroing in xe_oa_init_oa_buffer() remains necessary forzero report-id/timestamp detection on enable/re-enable.\n(cherry picked from commit 126c4c5388f9311a390b9b254a835b0cf0f55331)\nhttps://www.cve.org/CVERecord?id=CVE-2026-99208https://git.kernel.org/stable/c/21f41b6daf0dbe2cdaaf9f54af6e23fd3c9190b9https://git.kernel.org/stable/c/cd3e2918c247db631d88cdd704596d9d27e5513ehttps://git.kernel.org/stable/c/fd8662823caa114a63f07222d2aa448f6ac5e864#kernel #Linux#CVE_2026_99208#bot", "url": "https://infosec.exchange/users/cve/statuses/117518407727407982"}, {"timestamp": "2026-10-28T12:31:08Z", "date_only": false, "value": "2026-10-28T12:31:08Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J8G3-C5F3-W4QH", "record": "GHSA-J8G3-C5F3-W4QH", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T12:31:08Z", "date_only": false, "value": "2026-10-28T12:31:08Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J8G3-C5F3-W4QH", "record": "GHSA-J8G3-C5F3-W4QH", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T06:06:45.178Z", "date_only": false, "value": "2026-10-30T06:06:45.178882Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99208", "record": "BELL-CVE-2026-99208", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:30:49Z", "date_only": false, "value": "2026-10-30T06:30:49Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99208", "record": "UBUNTU-CVE-2026-99208", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T06:35:42.812Z", "date_only": false, "value": "2026-10-30T06:35:42.812740Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99208", "record": "BELL-CVE-2026-99208", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-04T05:43:23.213Z", "anchors": {"origin": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99208", "record": "UBUNTU-CVE-2026-99208", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99208", "record": "UBUNTU-CVE-2026-99208", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 625403.213428, "hours": 173.7231148411111, "days": 7.238463118379629, "min_seconds": 539003.213428, "max_seconds": 625403.213428, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99208", "record": "UBUNTU-CVE-2026-99208", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-04T05:43:23.213Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}