{"metadata": {"vulnerability": "CVE-2026-99253", "count": 15, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-25T10:25:14.403Z", "date_only": false, "value": "2026-09-25T10:25:14.403Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99253", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-03T11:20:12.490Z", "date_only": false, "value": "2026-11-03T11:20:12.490Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99253", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-03T11:28:07.520Z", "date_only": false, "value": "2026-11-03T11:28:07.520249Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117552269633265853", "record": "CVE-2026-99253", "field": "creation_timestamp", "uuid": "2684ee07-8346-480f-8cfa-fc4283e5fe1b", "content": "CVE-2026-99253 io_uring/cancel: rearm local work wake up before sleep In the Linux kernel, the following vulnerability has been resolved:\nio_uring/cancel: rearm local work wake up before sleep\nio_uring_try_cancel_requests() sets ->cq_wait_nr to 1 so that the nextio_req_local_work_add() wakes the cancelling task. The add that takes thecount to zero is the only one that wakes, later ones see a count <= 0 andreturn. io_uring_cancel_generic() however only becomesTASK_INTERRUPTIBLE much later, so the one wake up can be spent on arunning task. That is fine as long as the entry of that add is stillqueued, as the io_local_work_pending() check then skips the sleep. It isnot if the add was delayed after queueing its entry:\nCPU0 (submitter in exec or exit)      CPU1 (io_req_local_work_add)                                      mpscq_push(req A)io_uring_try_cancel_requests()  io_run_local_work()  // runs req Aio_uring_try_cancel_requests()  atomic_set(&ctx->cq_wait_nr, 1)                                      atomic_read(&ctx->cq_wait_nr) == 1                                      count taken, wake_up_state()                                        // task is running, no-opprepare_to_wait(TASK_INTERRUPTIBLE)io_local_work_pending() == falseschedule()                                      mpscq_push(req B)                                      cq_wait_nr <= 0, return\nOnly the sleeping task can run req B, so it is stuck in execve() until asignal happens to wake it. An exiting task doesn't even get that.\nArm the count again once the task state is set and before the work listis checked, for the rings whose local work this task is the one to run.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99253https://git.kernel.org/stable/c/aaa06bb9fc03384f7cf2dbc3e43f2939cc7791b2#kernel #Linux#CVE_2026_99253#bot", "url": "https://infosec.exchange/users/cve/statuses/117552269633265853"}, {"timestamp": "2026-11-03T12:17:00Z", "date_only": false, "value": "2026-11-03T12:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99253", "record": "UBUNTU-CVE-2026-99253", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T12:17:32Z", "date_only": false, "value": "2026-11-03T12:17:32Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-C86R-6X5C-X35M", "record": "GHSA-C86R-6X5C-X35M", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-03T12:17:32.013Z", "date_only": false, "value": "2026-11-03T12:17:32.013", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99253", "record": "FKIE_CVE-2026-99253", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T12:31:50Z", "date_only": false, "value": "2026-11-03T12:31:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C86R-6X5C-X35M", "record": "GHSA-C86R-6X5C-X35M", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T04:42:29Z", "date_only": false, "value": "2026-11-05T04:42:29Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99253", "record": "UBUNTU-CVE-2026-99253", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T06:08:03.589Z", "date_only": false, "value": "2026-11-05T06:08:03.589758Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99253", "record": "BELL-CVE-2026-99253", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T06:30:22.670Z", "date_only": false, "value": "2026-11-05T06:30:22.670934Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99253", "record": "BELL-CVE-2026-99253", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T06:30:22.670Z", "date_only": false, "value": "2026-11-05T06:30:22.670934Z", "kind": "other", "label": "Withdrawn", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99253", "record": "BELL-CVE-2026-99253", "field": "withdrawn", "linked_record": true}, {"timestamp": "2026-11-06T17:15:12.869Z", "date_only": false, "value": "2026-11-06T17:15:12.869Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99253", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-06T17:15:12.869Z", "date_only": false, "value": "2026-11-06T17:15:12.869Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99253", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-06T18:18:33.357Z", "date_only": false, "value": "2026-11-06T18:18:33.357", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99253", "record": "FKIE_CVE-2026-99253", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-06T18:35:05Z", "date_only": false, "value": "2026-11-06T18:35:05Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-C86R-6X5C-X35M", "record": "GHSA-C86R-6X5C-X35M", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-07T04:15:58.601Z", "anchors": {"origin": {"timestamp": "2026-11-03T11:20:12.490Z", "date_only": false, "value": "2026-11-03T11:20:12.490Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99253", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-03T11:20:12.490Z", "date_only": false, "value": "2026-11-03T11:20:12.490Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99253", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 320146.111833, "hours": 88.92947550916666, "days": 3.705394812881944, "min_seconds": 320146.111833, "max_seconds": 320146.111833, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-03T11:20:12.490Z", "date_only": false, "value": "2026-11-03T11:20:12.490Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99253", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-07T04:15:58.601Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}