{"metadata": {"vulnerability": "CVE-2026-99254", "count": 21, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 13}}, "data": [{"timestamp": "2026-09-25T10:25:14.403Z", "date_only": false, "value": "2026-09-25T10:25:14.403Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99254", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-03T11:20:12.802Z", "date_only": false, "value": "2026-11-03T11:20:12.802Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99254", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-03T11:28:47.002Z", "date_only": false, "value": "2026-11-03T11:28:47.002124Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117552272279380729", "record": "CVE-2026-99254", "field": "creation_timestamp", "uuid": "cf151f09-a8ae-4d89-b879-4e329cdc049b", "content": "CVE-2026-99254 io_uring: don't flood a cancelling task with task_work In the Linux kernel, the following vulnerability has been resolved:\nio_uring: don't flood a cancelling task with task_work\nio_ring_exit_work() asks each task which has used the ring to remove itstctx node, by task_work, and repeats that until the list is empty.io_tctx_exit_cb() doesn't touch the node while the task is inio_uring_cancel_generic(), which removes all the nodes at its end. So thework item queues the callback again as soon as it has completed, fornothing.\nThat is more than a waste of time. task_work_run() only returns when itfinds the list empty. If the rings are released from inside thecancellation, because requests of other rings held the last references totheir files, up to 64 work items keep sending callbacks to the one taskwhich is running them. It never finds the list empty, never gets back tothe cancellation, the nodes stay, and so it goes on: a task with 60 pairsof rings which poll each other ran 280000 callbacks in 5 seconds, 20seconds after exit_group(). It ends when all the senders happen to be lateat the same time. Until then the task keeps a CPU and the work items busy.\nAn exiting task can't be killed meanwhile. execve() cancels the requests inthe same way, so a live task can get stuck there as well, for minutes. Ifit takes more than five, the work items run into theWARN_ON_ONCE(time_after(jiffies, timeout)) of io_ring_exit_work(). Noprivilege is needed for any of this.\nIf the callback has met a task in cancellation, wait a little before it issent again. Nobody has to wake the work item up for that: either the nodeis gone by then, or it is the turn of the next round.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99254https://git.kernel.org/stable/c/a22fb44e988b01b82235ea07f0bf0fc73e256596https://git.kernel.org/stable/c/2c75ebae8a7f09c99e31c7042b7d4d595f03b2b1https://git.kernel.org/stable/c/61c761fc21e00e45c33c2bb596be442d92fb8792https://git.kernel.org/stable/c/14f56e9c0b8fdc2e178acdbec9781e90ef46f7e9https://git.kernel.org/stable/c/abdc57c7ebabaaf0b622178a6a85834e1e54ff80#kernel #Linux#CVE_2026_99254#bot", "url": "https://infosec.exchange/users/cve/statuses/117552272279380729"}, {"timestamp": "2026-11-03T12:17:00Z", "date_only": false, "value": "2026-11-03T12:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99254", "record": "UBUNTU-CVE-2026-99254", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T12:17:32Z", "date_only": false, "value": "2026-11-03T12:17:32Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-G7FP-PVXQ-GGJ5", "record": "GHSA-G7FP-PVXQ-GGJ5", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-03T12:17:32.137Z", "date_only": false, "value": "2026-11-03T12:17:32.137", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99254", "record": "FKIE_CVE-2026-99254", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T12:31:50Z", "date_only": false, "value": "2026-11-03T12:31:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-G7FP-PVXQ-GGJ5", "record": "GHSA-G7FP-PVXQ-GGJ5", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-04T01:03:19Z", "date_only": false, "value": "2026-11-04T01:03:19.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99254", "record": "MSRC_CVE-2026-99254", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-04T01:03:19Z", "date_only": false, "value": "2026-11-04T01:03:19.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99254", "record": "MSRC_CVE-2026-99254", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-04T01:03:19Z", "date_only": false, "value": "2026-11-04T01:03:19.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99254", "record": "MSRC_CVE-2026-99254", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-04T14:46:35Z", "date_only": false, "value": "2026-11-04T14:46:35.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99254", "record": "MSRC_CVE-2026-99254", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-05T06:08:03.648Z", "date_only": false, "value": "2026-11-05T06:08:03.648654Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99254", "record": "BELL-CVE-2026-99254", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T06:30:22.736Z", "date_only": false, "value": "2026-11-05T06:30:22.736384Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99254", "record": "BELL-CVE-2026-99254", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T14:54:22Z", "date_only": false, "value": "2026-11-05T14:54:22.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99254", "record": "MSRC_CVE-2026-99254", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-05T14:54:22Z", "date_only": false, "value": "2026-11-05T14:54:22.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99254", "record": "MSRC_CVE-2026-99254", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-06T08:00:55.457Z", "date_only": false, "value": "2026-11-06T08:00:55.457Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99254", "record": "MSRC_CVE-2026-99254", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-06T10:52:20Z", "date_only": false, "value": "2026-11-06T10:52:20Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99254", "record": "UBUNTU-CVE-2026-99254", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-06T17:15:13.328Z", "date_only": false, "value": "2026-11-06T17:15:13.328Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99254", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-06T17:15:13.328Z", "date_only": false, "value": "2026-11-06T17:15:13.328Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99254", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-06T18:18:33.490Z", "date_only": false, "value": "2026-11-06T18:18:33.490", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99254", "record": "FKIE_CVE-2026-99254", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-06T18:35:05Z", "date_only": false, "value": "2026-11-06T18:35:05Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-G7FP-PVXQ-GGJ5", "record": "GHSA-G7FP-PVXQ-GGJ5", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-08T05:13:50.562Z", "anchors": {"origin": {"timestamp": "2026-11-03T11:20:12.802Z", "date_only": false, "value": "2026-11-03T11:20:12.802Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99254", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-03T11:20:12.802Z", "date_only": false, "value": "2026-11-03T11:20:12.802Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99254", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": {"timestamp": "2026-11-04T01:03:19Z", "date_only": false, "value": "2026-11-04T01:03:19.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99254", "record": "MSRC_CVE-2026-99254", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": false, "missing": ["start"]}, "disclosure_to_patch": {"available": true, "seconds": 49386.198, "hours": 13.718388333333332, "days": 0.5715995138888889, "min_seconds": 49386.198, "max_seconds": 49386.198, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-03T11:20:12.802Z", "date_only": false, "value": "2026-11-03T11:20:12.802Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99254", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-04T01:03:19Z", "date_only": false, "value": "2026-11-04T01:03:19.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99254", "record": "MSRC_CVE-2026-99254", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "time_unpatched": {"available": true, "seconds": 49386.198, "hours": 13.718388333333332, "days": 0.5715995138888889, "min_seconds": 49386.198, "max_seconds": 49386.198, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-03T11:20:12.802Z", "date_only": false, "value": "2026-11-03T11:20:12.802Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99254", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-04T01:03:19Z", "date_only": false, "value": "2026-11-04T01:03:19.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99254", "record": "MSRC_CVE-2026-99254", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}