{"metadata": {"vulnerability": "CVE-2026-99285", "count": 10, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 5}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-25T10:25:14.405Z", "date_only": false, "value": "2026-09-25T10:25:14.405Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99285", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-10T17:37:13.348Z", "date_only": false, "value": "2026-11-10T17:37:13.348Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99285", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T17:37:13.348Z", "date_only": false, "value": "2026-11-10T17:37:13.348Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99285", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-10T17:37:13.348Z", "date_only": false, "value": "2026-11-10T17:37:13.348Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99285", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-10T17:41:57.122Z", "date_only": false, "value": "2026-11-10T17:41:57.122796Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117593375800411606", "record": "CVE-2026-99285", "field": "creation_timestamp", "uuid": "39c1fb9c-61cc-4ff5-91e3-5dee1c4c7e3c", "content": "CVE-2026-99285 netfilter: nft_byteorder: remove multi-register support In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: nft_byteorder: remove multi-register support\n64bit byteorder conversion is broken when several registers need to beconverted because the source register array advances in steps for 4 bytesinstead of 8:\n  for (i = ...      src64 = nft_reg_load64(&src[i]);                             ~~~~~ u32 *src      nft_reg_store64(&dst64[i],\nRemove the multi-register support, it has other issues as well:\nPablo points out that commitcaf3ef7468f7 (\"netfilter: nf_tables: prevent OOB access in nft_byteorder_eval\")alters semantics: before the loop operated on registers, i.e. for ( ... )   dst32[i] = htons((u16)src32[i])\n .. but after the patch it will operate on bytes, which makes this useless to convert e.g. concatenations, which store each compound in its own register.\nMulti-convert of u32 has one theoretical application:\nct mark . meta mark . tcp dport @intervalset\nBecause ct mark and meta mark are host byte order, use withintervals has to convert the byteorder for ct/meta mark valueto network byte order (bigendian).\nnftables emits this: [ meta load mark => reg 1 ] [ byteorder reg 1 = hton(reg 1, 4, 4) ] [ ct load mark => reg 9 ] [ byteorder reg 9 = hton(reg 9, 4, 4) ] ...\nI.e. two separate calls.  Theoretically it could be changed to do: [ meta load mark => reg 1 ] [ ct load mark => reg 9 ] [ byteorder reg 1 = htonl(reg 1, 4, 8) ] ...\nBut then all it would take to change the set tometa mark . tcp dport . ct mark\n... and we'd be back to two \"byteorder\" calls. IOW, support toconvert a range of registers is both dysfunctional and dubious.\nSimplify this: remove the feature.\nPablo Neira Ayuso points out that nftables before 1.1.0 can generateincorrect byteorder conversions, see 9fe58952c45a,\"evaluate: skip byteorder conversion for selector smaller than 2 bytes\"in nftables.git).  Affected rulesets fail to load with this change andold userspace due to 'len != size' check.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99285https://git.kernel.org/stable/c/3c5fb3a6c8118d15e60295e76fb5b879021eef43https://git.kernel.org/stable/c/dc29c0478b8564feb9371e715b5a0016eb8903fdhttps://git.kernel.org/stable/c/bb061d3de41707415269be75ebf700efb03ec212#kernel #Linux#CVE_2026_99285#bot", "url": "https://infosec.exchange/users/cve/statuses/117593375800411606"}, {"timestamp": "2026-11-10T18:17:49Z", "date_only": false, "value": "2026-11-10T18:17:49Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VMHM-3CG3-FM3J", "record": "GHSA-VMHM-3CG3-FM3J", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-10T18:17:49.147Z", "date_only": false, "value": "2026-11-10T18:17:49.147", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99285", "record": "FKIE_CVE-2026-99285", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T18:17:49.147Z", "date_only": false, "value": "2026-11-10T18:17:49.147", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99285", "record": "FKIE_CVE-2026-99285", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-10T18:31:54Z", "date_only": false, "value": "2026-11-10T18:31:54Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VMHM-3CG3-FM3J", "record": "GHSA-VMHM-3CG3-FM3J", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T18:31:54Z", "date_only": false, "value": "2026-11-10T18:31:54Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VMHM-3CG3-FM3J", "record": "GHSA-VMHM-3CG3-FM3J", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-10T23:50:07.934Z", "anchors": {"origin": {"timestamp": "2026-11-10T17:37:13.348Z", "date_only": false, "value": "2026-11-10T17:37:13.348Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99285", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-10T17:37:13.348Z", "date_only": false, "value": "2026-11-10T17:37:13.348Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99285", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 22374.58658, "hours": 6.215162938888889, "days": 0.2589651224537037, "min_seconds": 22374.58658, "max_seconds": 22374.58658, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T17:37:13.348Z", "date_only": false, "value": "2026-11-10T17:37:13.348Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99285", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-10T23:50:07.934Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}