{"metadata": {"vulnerability": "CVE-2026-99226", "count": 26, "kinds": {"milestone": 8, "sighting": 1, "kev": 0, "other": 17}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-25T10:25:14.402Z", "date_only": false, "value": "2026-09-25T10:25:14.402Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99226", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-02T16:06:35.362Z", "date_only": false, "value": "2026-11-02T16:06:35.362Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99226", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-02T16:17:00Z", "date_only": false, "value": "2026-11-02T16:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99226", "record": "UBUNTU-CVE-2026-99226", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T16:17:47Z", "date_only": false, "value": "2026-11-02T16:17:47Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9PJV-MG4C-3J9M", "record": "GHSA-9PJV-MG4C-3J9M", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-02T16:17:47.233Z", "date_only": false, "value": "2026-11-02T16:17:47.233", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99226", "record": "FKIE_CVE-2026-99226", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T16:33:36.043Z", "date_only": false, "value": "2026-11-02T16:33:36.043205Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117547763949834810", "record": "CVE-2026-99226", "field": "creation_timestamp", "uuid": "e02418aa-23c8-4b63-8e5e-e95a6a5a51e5", "content": "CVE-2026-99226 keys: Avoid the owner account dereference in named keyring lookup In the Linux kernel, the following vulnerability has been resolved:\nkeys: Avoid the owner account dereference in named keyring lookup\nNamed keyring lookup must keep the storage containing the owner UIDalive through the namespace mapping check.  find_keyring_by_name()reads keyring->user->uid under keyring_name_lock, but that lock protectsthe keyring's name entry and allocation, not its separate key_user.\nA named session-keyring join can overlap a privileged KEYCTL_CHOWN onanother CPU.  If the keyring holds the last reference to its old dynamickey_user and the ownership transfer succeeds, the following ordering ispossible:\n    Named join                         Chown    find_keyring_by_name()              keyctl_chown_key()      read_lock(keyring_name_lock)       down_write(key->sem)      load old keyring->user                                         replace key->user and key->uid                                         up_write(key->sem)                                         key_put(key)                                         key_user_put(old user): free      read old user->uid      read_unlock(keyring_name_lock)\nChown neither takes keyring_name_lock nor key_session_mutex, so it canfree the old account between the pointer load and the UID read.  Thelookup then reads freed memory even though the keyring itself is alive.\nUse keyring->uid for the mapping check.  key_alloc() initializes thisinline owner UID and keyctl_chown_key() updates it on chown.The existing name lock keeps its containing keyring allocated throughoutthe check, so lookup no longer depends on the account's lifetime.  Thisalso matches the owner UID used by the permission check.\nKASAN report as below:\n    BUG: KASAN: slab-use-after-free in find_keyring_by_name+0x577/0x5d0    Read of size 4 at addr ffff8881128ae2ec by task keycase/500\nhttps://www.cve.org/CVERecord?id=CVE-2026-99226https://git.kernel.org/stable/c/77249d4b1bb5ad43552b7023c4a0978937aa7a56https://git.kernel.org/stable/c/0b865fa477d94ac96c26848aab1fd176397de3f6https://git.kernel.org/stable/c/6763329f673d261641c79212abf773af77b2c922https://git.kernel.org/stable/c/aa03c8fb4334f14d218020f7431debf2b7766865https://git.kernel.org/stable/c/c9664f780f861dd9f11f120c7a03ed0993671ebbhttps://git.kernel.org/stable/c/b0830a26e2c3008a6e21863126b4a0e68b2761cdhttps://git.kernel.org/stable/c/5c6a9512887a6cc694d594d9c0b57c0841d215b5https://git.kernel.org/stable/c/40b12b93ae4ab9e22c3d571e9b09fd08afad53f6#kernel #Linux#CVE_2026_99226#bot", "url": "https://infosec.exchange/users/cve/statuses/117547763949834810"}, {"timestamp": "2026-11-02T18:32:27Z", "date_only": false, "value": "2026-11-02T18:32:27Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9PJV-MG4C-3J9M", "record": "GHSA-9PJV-MG4C-3J9M", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T23:00:00Z", "date_only": false, "value": "2026-11-02T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4302", "record": "WID-SEC-W-2026-4302", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-02T23:00:00Z", "date_only": false, "value": "2026-11-02T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4302", "record": "WID-SEC-W-2026-4302", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T23:00:00Z", "date_only": false, "value": "2026-11-02T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4302", "record": "WID-SEC-W-2026-4302", "field": "vulnerabilities.9.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-03T19:12:58.803Z", "date_only": false, "value": "2026-11-03T19:12:58.803Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99226", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-03T19:12:58.803Z", "date_only": false, "value": "2026-11-03T19:12:58.803Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99226", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-03T20:18:28.183Z", "date_only": false, "value": "2026-11-03T20:18:28.183", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99226", "record": "FKIE_CVE-2026-99226", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-03T21:32:00Z", "date_only": false, "value": "2026-11-03T21:32:00Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9PJV-MG4C-3J9M", "record": "GHSA-9PJV-MG4C-3J9M", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T23:00:00Z", "date_only": false, "value": "2026-11-03T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4302", "record": "WID-SEC-W-2026-4302", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-03T23:00:00Z", "date_only": false, "value": "2026-11-03T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4302", "record": "WID-SEC-W-2026-4302", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-04T01:02:12Z", "date_only": false, "value": "2026-11-04T01:02:12.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99226", "record": "MSRC_CVE-2026-99226", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-04T01:02:12Z", "date_only": false, "value": "2026-11-04T01:02:12.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99226", "record": "MSRC_CVE-2026-99226", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-04T01:02:12Z", "date_only": false, "value": "2026-11-04T01:02:12.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99226", "record": "MSRC_CVE-2026-99226", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-04T11:19:06.034Z", "date_only": false, "value": "2026-11-04T11:19:06.034+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4302", "record": "WID-SEC-W-2026-4302", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-05T06:08:02.344Z", "date_only": false, "value": "2026-11-05T06:08:02.344847Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99226", "record": "BELL-CVE-2026-99226", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T06:30:21.372Z", "date_only": false, "value": "2026-11-05T06:30:21.372229Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99226", "record": "BELL-CVE-2026-99226", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T14:53:04Z", "date_only": false, "value": "2026-11-05T14:53:04.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99226", "record": "MSRC_CVE-2026-99226", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-05T14:53:04Z", "date_only": false, "value": "2026-11-05T14:53:04.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99226", "record": "MSRC_CVE-2026-99226", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-06T08:00:55.456Z", "date_only": false, "value": "2026-11-06T08:00:55.456Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99226", "record": "MSRC_CVE-2026-99226", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-09T23:59:02Z", "date_only": false, "value": "2026-11-09T23:59:02Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99226", "record": "UBUNTU-CVE-2026-99226", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-10T18:32:28.637Z", "anchors": {"origin": {"timestamp": "2026-11-02T16:06:35.362Z", "date_only": false, "value": "2026-11-02T16:06:35.362Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99226", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-02T16:06:35.362Z", "date_only": false, "value": "2026-11-02T16:06:35.362Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99226", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": {"timestamp": "2026-11-04T01:02:12Z", "date_only": false, "value": "2026-11-04T01:02:12.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99226", "record": "MSRC_CVE-2026-99226", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": false, "missing": ["start"]}, "disclosure_to_patch": {"available": true, "seconds": 118536.638, "hours": 32.92684388888889, "days": 1.3719518287037038, "min_seconds": 118536.638, "max_seconds": 118536.638, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-02T16:06:35.362Z", "date_only": false, "value": "2026-11-02T16:06:35.362Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99226", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-04T01:02:12Z", "date_only": false, "value": "2026-11-04T01:02:12.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99226", "record": "MSRC_CVE-2026-99226", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "time_unpatched": {"available": true, "seconds": 118536.638, "hours": 32.92684388888889, "days": 1.3719518287037038, "min_seconds": 118536.638, "max_seconds": 118536.638, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-02T16:06:35.362Z", "date_only": false, "value": "2026-11-02T16:06:35.362Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99226", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-04T01:02:12Z", "date_only": false, "value": "2026-11-04T01:02:12.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99226", "record": "MSRC_CVE-2026-99226", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}