{"metadata": {"vulnerability": "CVE-2026-99271", "count": 10, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-09-25T10:25:14.404Z", "date_only": false, "value": "2026-09-25T10:25:14.404Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99271", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-07T14:08:45.047Z", "date_only": false, "value": "2026-11-07T14:08:45.047Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99271", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-07T14:08:45.047Z", "date_only": false, "value": "2026-11-07T14:08:45.047Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99271", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-07T14:08:45.047Z", "date_only": false, "value": "2026-11-07T14:08:45.047Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99271", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-07T14:15:04.671Z", "date_only": false, "value": "2026-11-07T14:15:04.671074Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117575575312900205", "record": "CVE-2026-99271", "field": "creation_timestamp", "uuid": "5f9811db-8beb-4658-b290-2ef6b75eaaf1", "content": "CVE-2026-99271 ALSA: line6: Clear prev_fbuf on capture buffer release In the Linux kernel, the following vulnerability has been resolved:\nALSA: line6: Clear prev_fbuf on capture buffer release\nA KASAN slab-use-after-free read was reported in submit_audio_out_urb()when generating an impulse test signal:\n  BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline]  BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249  Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785\n  Allocated by task 11:   kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144   line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158   line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329   line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728\n  Freed by task 7785:   kfree+0xf8/0x390 mm/slub.c:6566   line6_buffer_release sound/usb/line6/pcm.c:176 [inline]   line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170   __line6_pcm_release sound/usb/line6/pcm.c:305 [inline]   line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313   snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183\nline6pcm->prev_fbuf points into the capture PCM stream buffer(line6pcm->in.buffer), which is updated during audio_in_callback() tofeed rate synchronization, software monitoring, and impulse test signalgeneration on playback side.\nWhen all capture streams are closed, line6_buffer_release() freespstr->buffer with kfree().  However, it does not clear line6pcm->prev_fbuf.If playback is subsequently started (e.g. via impulse test signalvolume control snd_line6_impulse_volume_put()), submit_audio_out_urb()dereferences the stale pointer line6pcm->prev_fbuf under in.lock,resulting in a slab-use-after-free read.\nClear prev_fbuf and prev_fsize in line6_buffer_release() when releasingthe capture stream buffer under in.lock, ensuring that no stale bufferpointer can be accessed by submit_audio_out_urb().\nhttps://www.cve.org/CVERecord?id=CVE-2026-99271https://git.kernel.org/stable/c/862d9268f40a6e10cef24eb226e738fb69ce8aa7https://git.kernel.org/stable/c/22c82f33ff0b68d37041adf1dea5533a5863cd31https://git.kernel.org/stable/c/aa118c8f61d59387961d58ffae831c5259a9f222#kernel #Linux#CVE_2026_99271#bot", "url": "https://infosec.exchange/users/cve/statuses/117575575312900205"}, {"timestamp": "2026-11-07T14:17:02Z", "date_only": false, "value": "2026-11-07T14:17:02Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-M889-VHR2-V9VX", "record": "GHSA-M889-VHR2-V9VX", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-07T14:17:02.337Z", "date_only": false, "value": "2026-11-07T14:17:02.337", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99271", "record": "FKIE_CVE-2026-99271", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-07T14:17:02.337Z", "date_only": false, "value": "2026-11-07T14:17:02.337", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99271", "record": "FKIE_CVE-2026-99271", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-07T15:30:28Z", "date_only": false, "value": "2026-11-07T15:30:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-M889-VHR2-V9VX", "record": "GHSA-M889-VHR2-V9VX", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-07T15:30:28Z", "date_only": false, "value": "2026-11-07T15:30:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-M889-VHR2-V9VX", "record": "GHSA-M889-VHR2-V9VX", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-07T19:20:11.421Z", "anchors": {"origin": {"timestamp": "2026-11-07T14:08:45.047Z", "date_only": false, "value": "2026-11-07T14:08:45.047Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99271", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-07T14:08:45.047Z", "date_only": false, "value": "2026-11-07T14:08:45.047Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99271", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 18686.374741, "hours": 5.1906596502777775, "days": 0.21627748542824074, "min_seconds": 18686.374741, "max_seconds": 18686.374741, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-07T14:08:45.047Z", "date_only": false, "value": "2026-11-07T14:08:45.047Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99271", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-07T19:20:11.421Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}