{"metadata": {"vulnerability": "CVE-2026-99255", "count": 20, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 12}}, "data": [{"timestamp": "2026-09-25T10:25:14.404Z", "date_only": false, "value": "2026-09-25T10:25:14.404Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99255", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-03T11:20:13.169Z", "date_only": false, "value": "2026-11-03T11:20:13.169Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99255", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-03T11:29:27.732Z", "date_only": false, "value": "2026-11-03T11:29:27.732141Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117552274940386804", "record": "CVE-2026-99255", "field": "creation_timestamp", "uuid": "dce86af2-9cad-4f98-b025-991752453912", "content": "CVE-2026-99255 io_uring/io-wq: don't hide a link from cancellations In the Linux kernel, the following vulnerability has been resolved:\nio_uring/io-wq: don't hide a link from cancellations\nA task that exits cancels its tracked requests and waits until they aregone. io_uring_cancel_generic() looks everywhere a request can be, andgoes to sleep if it found nothing to cancel. It is woken up each timeone of the requests of the task is completed by task work or freed.\nWhen io-wq is done with a request that has a link, there is a time in whichthe next request of the link can't be found:\n  io_worker_handle_work()    io_assign_current_work(worker, NULL)    io_wq_free_work(work)      io_req_find_next()           // takes the link off the request      io_free_req()                // task work for the task    io_assign_current_work(worker, linked)      io_run_task_work()      cond_resched()      worker->cur_work = linked\nIt is not pending, it is not the current work of a worker, and it is notyet on the list that it is about to be parked on. If the pass that theexiting task makes because of io_free_req() falls into that time, it findsnothing and the task goes to sleep. The worker then runs the link, whichIO_WQ_BIT_EXIT doesn't prevent for bounded work. If that parks the requestnothing is completed or freed, and nobody wakes up the task. If it is theprocess that exits it can't be killed any more either.\n  NOP, IOSQE_ASYNC | IOSQE_IO_LINK  FUTEX_WAIT, FUTEX2_PRIVATE  exit of the thread, or of the process, up to 63us later\nWith four of these per round 5 to 8 of 10,000 rounds hang (4 CPUs, KVM):\n  io_uring_cancel_generic  do_exit\nCommit f8b632e89a10 (\"io_uring: tighten task exit cancellations\") is aboutthe same gap, and makes the task look again for whatever happens beforeio_free_req().\nFree the request once the link is the current work of the worker, orpending. Whoever is woken up by that can find the link, until it is parkedwhere cancellations look as well. To do so split io_wq_free_work() in two.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99255https://git.kernel.org/stable/c/98470f164286f7f62aaee519d4d11b9370ce6d7bhttps://git.kernel.org/stable/c/d39ebc7a583d650b1d6da9b45e2ce96ad4d877e4https://git.kernel.org/stable/c/ebe8e97fb99d9f374c482902a00677cfd24a6c27https://git.kernel.org/stable/c/3e02b8df0e9fa1423ac2a4e03409a9329c30ac49https://git.kernel.org/stable/c/92e20e9c72bdf6cfa6f84eded7b33399bc7061da#kernel #Linux#CVE_2026_99255#bot", "url": "https://infosec.exchange/users/cve/statuses/117552274940386804"}, {"timestamp": "2026-11-03T12:17:00Z", "date_only": false, "value": "2026-11-03T12:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99255", "record": "UBUNTU-CVE-2026-99255", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T12:17:32Z", "date_only": false, "value": "2026-11-03T12:17:32Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-V9JM-VMFJ-9VH2", "record": "GHSA-V9JM-VMFJ-9VH2", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-03T12:17:32.290Z", "date_only": false, "value": "2026-11-03T12:17:32.290", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99255", "record": "FKIE_CVE-2026-99255", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T12:31:50Z", "date_only": false, "value": "2026-11-03T12:31:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-V9JM-VMFJ-9VH2", "record": "GHSA-V9JM-VMFJ-9VH2", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T19:13:14.626Z", "date_only": false, "value": "2026-11-03T19:13:14.626Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99255", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-03T19:13:14.626Z", "date_only": false, "value": "2026-11-03T19:13:14.626Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99255", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-03T20:18:31.520Z", "date_only": false, "value": "2026-11-03T20:18:31.520", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99255", "record": "FKIE_CVE-2026-99255", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-03T21:32:06Z", "date_only": false, "value": "2026-11-03T21:32:06Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-V9JM-VMFJ-9VH2", "record": "GHSA-V9JM-VMFJ-9VH2", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-04T01:03:21Z", "date_only": false, "value": "2026-11-04T01:03:21.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99255", "record": "MSRC_CVE-2026-99255", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-04T01:03:21Z", "date_only": false, "value": "2026-11-04T01:03:21.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99255", "record": "MSRC_CVE-2026-99255", "field": "vulnerabilities.0.remediations.0.date", "linked_record": true}, {"timestamp": "2026-11-04T01:03:21Z", "date_only": false, "value": "2026-11-04T01:03:21.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99255", "record": "MSRC_CVE-2026-99255", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-04T14:46:40Z", "date_only": false, "value": "2026-11-04T14:46:40.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99255", "record": "MSRC_CVE-2026-99255", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-04T14:46:40Z", "date_only": false, "value": "2026-11-04T14:46:40.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99255", "record": "MSRC_CVE-2026-99255", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-05T04:42:29Z", "date_only": false, "value": "2026-11-05T04:42:29Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99255", "record": "UBUNTU-CVE-2026-99255", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T06:08:03.706Z", "date_only": false, "value": "2026-11-05T06:08:03.706813Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99255", "record": "BELL-CVE-2026-99255", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T06:30:22.806Z", "date_only": false, "value": "2026-11-05T06:30:22.806881Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99255", "record": "BELL-CVE-2026-99255", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T08:00:26.621Z", "date_only": false, "value": "2026-11-05T08:00:26.621Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99255", "record": "MSRC_CVE-2026-99255", "field": "document.tracking.generator.date", "linked_record": true}], "metrics": {"as_of": "2026-11-06T07:11:07.592Z", "anchors": {"origin": {"timestamp": "2026-11-03T11:20:13.169Z", "date_only": false, "value": "2026-11-03T11:20:13.169Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99255", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-03T11:20:13.169Z", "date_only": false, "value": "2026-11-03T11:20:13.169Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99255", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 244254.423579, "hours": 67.84845099416667, "days": 2.827018791423611, "min_seconds": 244254.423579, "max_seconds": 244254.423579, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-03T11:20:13.169Z", "date_only": false, "value": "2026-11-03T11:20:13.169Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99255", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-06T07:11:07.592Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}