{"metadata": {"vulnerability": "CVE-2026-99264", "count": 13, "kinds": {"milestone": 5, "sighting": 1, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-09-25T10:25:14.404Z", "date_only": false, "value": "2026-09-25T10:25:14.404Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99264", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-03T11:48:16.173Z", "date_only": false, "value": "2026-11-03T11:48:16.173Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99264", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-03T11:52:46.244Z", "date_only": false, "value": "2026-11-03T11:52:46.244348Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117552366602141097", "record": "CVE-2026-99264", "field": "creation_timestamp", "uuid": "ed100993-e04e-409b-a12a-ab598914c4f5", "content": "CVE-2026-99264 io_uring/net: don't retry recv on uncommitted buffers In the Linux kernel, the following vulnerability has been resolved:\nio_uring/net: don't retry recv on uncommitted buffers\nCommit 41b70df5b38b (\"io_uring/net: commit partial buffers on retry\")commits ring provided buffers when a receive is going to be retried aftera partial transfer, so that another request using the same buffer groupcan't be handed the memory the first one keeps receiving into. It commitsthe number of bytes received so far. That does the job for a singlebuffer which is consumed as a whole, but the request hangs on to all ithas mapped:\n- For a buffer ring with IOU_PBUF_RING_INC only these bytes are consumed.  The rest of the buffer stays at the head of the ring.- For a bundle only the buffers which hold these bytes are consumed, the  others that were peeked stay in the ring.\nIn both cases the next receive with that buffer group gets memory thatthe retried request is still going to write to, and whoever comes lastoverwrites the data of the other. What the retry fills isn't committed atall, as the buffer list isn't known any more at that point. So the kernelhands it out again later on, while the CQE tells the application that itwas used, and for an incremental buffer that it is done with.\nThe remainder can't be committed in advance: if the request ends upreceiving less, there is no way to tell the application that more wasconsumed than the CQE accounts for. Complete the request with what it hasgot instead of retrying it. MSG_WAITALL is no longer honoured forreceives into incremental buffers or multi buffer bundles, they canreturn a short count, with the request marked as failed like for othershort MSG_WAITALL transfers.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99264https://git.kernel.org/stable/c/21cb1770a56a51266ab96d4ed2a3b6979db59694https://git.kernel.org/stable/c/fc8506eea4498ecba26ef8bf6dbbd74af3dc891dhttps://git.kernel.org/stable/c/97b8dc36ba3cb176b74a7929140aeaeb40d5cdc0#kernel #Linux#CVE_2026_99264#bot", "url": "https://infosec.exchange/users/cve/statuses/117552366602141097"}, {"timestamp": "2026-11-03T12:17:00Z", "date_only": false, "value": "2026-11-03T12:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99264", "record": "UBUNTU-CVE-2026-99264", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T12:17:33Z", "date_only": false, "value": "2026-11-03T12:17:33Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-Q4WP-8VPQ-9RG3", "record": "GHSA-Q4WP-8VPQ-9RG3", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-03T12:17:33.490Z", "date_only": false, "value": "2026-11-03T12:17:33.490", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99264", "record": "FKIE_CVE-2026-99264", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T12:31:51Z", "date_only": false, "value": "2026-11-03T12:31:51Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-Q4WP-8VPQ-9RG3", "record": "GHSA-Q4WP-8VPQ-9RG3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T21:32:06Z", "date_only": false, "value": "2026-11-03T21:32:06Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-Q4WP-8VPQ-9RG3", "record": "GHSA-Q4WP-8VPQ-9RG3", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-04T18:21:35.307Z", "date_only": false, "value": "2026-11-04T18:21:35.307Z", "kind": "other", "label": "Rejected", "source": "cvelistv5", "record": "CVE-2026-99264", "field": "cveMetadata.dateRejected"}, {"timestamp": "2026-11-04T18:21:35.307Z", "date_only": false, "value": "2026-11-04T18:21:35.307Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99264", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-04T18:21:35.307Z", "date_only": false, "value": "2026-11-04T18:21:35.307Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99264", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-04T19:17:42.273Z", "date_only": false, "value": "2026-11-04T19:17:42.273", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99264", "record": "FKIE_CVE-2026-99264", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-06T10:52:23Z", "date_only": false, "value": "2026-11-06T10:52:23Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99264", "record": "UBUNTU-CVE-2026-99264", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-07T03:50:38.134Z", "anchors": {"origin": {"timestamp": "2026-11-03T11:48:16.173Z", "date_only": false, "value": "2026-11-03T11:48:16.173Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99264", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-03T11:48:16.173Z", "date_only": false, "value": "2026-11-03T11:48:16.173Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99264", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 316941.961337, "hours": 88.03943370472223, "days": 3.6683097376967595, "min_seconds": 316941.961337, "max_seconds": 316941.961337, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-03T11:48:16.173Z", "date_only": false, "value": "2026-11-03T11:48:16.173Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99264", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-07T03:50:38.134Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}