{"metadata": {"vulnerability": "CVE-2026-99278", "count": 20, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 12}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-25T10:25:14.405Z", "date_only": false, "value": "2026-09-25T10:25:14.405Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99278", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-07T14:08:46.983Z", "date_only": false, "value": "2026-11-07T14:08:46.983Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99278", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-07T14:08:46.983Z", "date_only": false, "value": "2026-11-07T14:08:46.983Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99278", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-07T14:08:46.983Z", "date_only": false, "value": "2026-11-07T14:08:46.983Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99278", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-07T14:17:03Z", "date_only": false, "value": "2026-11-07T14:17:03Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-HWFQ-RQVC-2QGH", "record": "GHSA-HWFQ-RQVC-2QGH", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-07T14:17:03.200Z", "date_only": false, "value": "2026-11-07T14:17:03.200", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99278", "record": "FKIE_CVE-2026-99278", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-07T14:17:03.200Z", "date_only": false, "value": "2026-11-07T14:17:03.200", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99278", "record": "FKIE_CVE-2026-99278", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-07T14:19:45.982Z", "date_only": false, "value": "2026-11-07T14:19:45.982362Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117575593856162526", "record": "CVE-2026-99278", "field": "creation_timestamp", "uuid": "1f5e08a8-757a-44c0-875d-7b540840e1f9", "content": "CVE-2026-99278 ksmbd: limit sessions on each connection In the Linux kernel, the following vulnerability has been resolved:\nksmbd: limit sessions on each connection\nThe pending setup limit only counts InProgress sessions. A client cancomplete authentication repeatedly and retain an unbounded number of Validsessions on one connection.\nReserve a connection slot before allocating a session and retain aconnection reference while authentication is in progress. The first SMB3channel takes over that reservation; binding to another connection reservesone slot there. Reauthentication and authentication continuation reuse theexisting reservation. Return slots on allocation or insertion failure,channel removal, and final session destruction.\nAccept max_sessions_per_connection in reserved startup-request space anddefault to 64 when older tools leave it zero. Keep the request size andexisting field offsets unchanged. Expose the configured limit in procfs.The existing connection limits bound the aggregate number of sessionswithout a separate global session allocation limit.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99278https://git.kernel.org/stable/c/94f8462fc9d5332bc54e91605003c17381e9171ahttps://git.kernel.org/stable/c/dc6aa1ba8b7fff8800ad9bf143f17d308e02ec68#kernel #Linux#CVE_2026_99278#bot", "url": "https://infosec.exchange/users/cve/statuses/117575593856162526"}, {"timestamp": "2026-11-07T15:30:28Z", "date_only": false, "value": "2026-11-07T15:30:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-HWFQ-RQVC-2QGH", "record": "GHSA-HWFQ-RQVC-2QGH", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-07T15:30:28Z", "date_only": false, "value": "2026-11-07T15:30:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-HWFQ-RQVC-2QGH", "record": "GHSA-HWFQ-RQVC-2QGH", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4414", "record": "WID-SEC-W-2026-4414", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4414", "record": "WID-SEC-W-2026-4414", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4414", "record": "WID-SEC-W-2026-4414", "field": "vulnerabilities.10.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-08T23:00:00Z", "date_only": false, "value": "2026-11-08T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4414", "record": "WID-SEC-W-2026-4414", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99278", "record": "UBUNTU-CVE-2026-99278", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T06:05:59.613Z", "date_only": false, "value": "2026-11-09T06:05:59.613375Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99278", "record": "BELL-CVE-2026-99278", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T06:17:26.400Z", "date_only": false, "value": "2026-11-09T06:17:26.400992Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99278", "record": "BELL-CVE-2026-99278", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-09T06:17:26.400Z", "date_only": false, "value": "2026-11-09T06:17:26.400992Z", "kind": "other", "label": "Withdrawn", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99278", "record": "BELL-CVE-2026-99278", "field": "withdrawn", "linked_record": true}, {"timestamp": "2026-11-09T12:27:02.934Z", "date_only": false, "value": "2026-11-09T12:27:02.934+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4414", "record": "WID-SEC-W-2026-4414", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-09T23:59:12Z", "date_only": false, "value": "2026-11-09T23:59:12Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99278", "record": "UBUNTU-CVE-2026-99278", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-10T23:52:39.264Z", "anchors": {"origin": {"timestamp": "2026-11-07T14:08:46.983Z", "date_only": false, "value": "2026-11-07T14:08:46.983Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99278", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-07T14:08:46.983Z", "date_only": false, "value": "2026-11-07T14:08:46.983Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99278", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 294232.281095, "hours": 81.73118919305556, "days": 3.405466216377315, "min_seconds": 294232.281095, "max_seconds": 294232.281095, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-07T14:08:46.983Z", "date_only": false, "value": "2026-11-07T14:08:46.983Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99278", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-10T23:52:39.264Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}