{"metadata": {"vulnerability": "cve-2026-99005", "count": 19, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-09-25T10:25:14.385Z", "date_only": false, "value": "2026-09-25T10:25:14.385Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-99005", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:20:30.462Z", "date_only": false, "value": "2026-10-23T12:20:30.462Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-99005", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T12:20:30.462Z", "date_only": false, "value": "2026-10-23T12:20:30.462Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-99005", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T12:20:30.462Z", "date_only": false, "value": "2026-10-23T12:20:30.462Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "cve-2026-99005", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99005", "record": "UBUNTU-CVE-2026-99005", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:17:22Z", "date_only": false, "value": "2026-10-23T13:17:22Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VCPF-23W8-Q6WV", "record": "GHSA-VCPF-23W8-Q6WV", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-23T13:17:22.893Z", "date_only": false, "value": "2026-10-23T13:17:22.893", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99005", "record": "FKIE_CVE-2026-99005", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:17:22.893Z", "date_only": false, "value": "2026-10-23T13:17:22.893", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99005", "record": "FKIE_CVE-2026-99005", "field": "lastModified"}, {"timestamp": "2026-10-23T13:43:30.686Z", "date_only": false, "value": "2026-10-23T13:43:30.686081Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490516631480787", "record": "CVE-2026-99005", "field": "creation_timestamp", "uuid": "71a2026c-5f43-4a24-8722-d47446130de6", "content": "CVE-2026-99005 drm/i915/gt: Unmask interrupts only when ACTIVE is true In the Linux kernel, the following vulnerability has been resolved:\ndrm/i915/gt: Unmask interrupts only when ACTIVE is true\nThere is a small race window between intel_rps_boost() readinga stale ACTIVE state and queuing rps->work, where ACTIVE may bechanged via asynchronous calls triggered by wakeref drop.This means that rps_work() could be triggered after the GT hasbeen parked, so unmasking RPS PM interrupts would happen withoutholding PM wakelock. This sequence of events may be observedduring live_rc6_ctx_wa() selftest:\n1) live_rc6_ctx_wa()   -> intel_engine_pm_put()      -> wakeref_put()\nASYNC1) wakeref_put() callback          -> __engine_park()             -> intel_gt_pm_put_async()                -> intel_gt_pm_put_async_untracked()                   -> intel_wakeref_put_async()\nASYNC2) wakeref_put_async() callback          -> __gt_park()             -> intel_rps_park()                -> intel_rps_clear_active() [clear ACTIVE]                WITH INTERRUPTS:                -> rps_disable_interrupts()                   -> cancel_work_sync(rps->work)                   -> rps_reset_interrupts() [rps->pm_iir = 0]                WITHOUT INTERRUPTS (TIMER mode):                -> rps_stop_timer()                   -> cancel_work_sync(rps->work)\n2) live_rc6_ctx_wa()   -> intel_gt_wait_for_idle()      -> intel_gt_retire_requests_timeout()         -> dma_fence_wait_timeout()            -> ops->wait() [i915_fence_wait()]               -> i915_request_wait_timeout()                  -> intel_rps_boost()                     -> intel_rps_is_active() [check ACTIVE]                        [OPEN RACE WINDOW]                     -> queue_work(rps->work)         -> retire_requests()            -> i915_request_retire()               -> intel_rps_dec_waiters() [from 1 to 0]\nIf ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW],then:\n3) rps_work() executes from the workqueue and may satisfy   \"(!pm_iir && !client_boost)\" test (in TIMER mode rps->pm_iir   is zeroed by an earlier rps_work() call or never gets a new   value after previous intel_rps_unpark() event), so it jumps   to \"out\" label, bypassing intel_rps_is_active() guard and   executes gen6_gt_pm_unmask_irq();\n4) GT is parked and runtime PM wakelock is dropped, so only   a raw reference in __gt_park() ->   intel_display_power_put_async() remains for 100ms, then the   MMIO write in gen6_gt_pm_unmask_irq() detects missing   wakelock via assert_rpm_wakelock_held() and emits   \"RPM wakelock ref not held during HW access\" tainting kernel.\nCommit 3e7abf814193 (\"drm/i915: Extract GT render power state management\")dropped the \"if (rps->interrupts_enabled)\" guard thatgen6_pm_rps_work() had around this unmask in i915_irq.c.INTEL_RPS_ACTIVE brackets the same window, since it is set inintel_rps_unpark() before rps_enable_interrupts() andrps_start_timer() and cleared in intel_rps_park() beforerps_stop_timer() and rps_disable_interrupts().\nSkip unmasking when RPS is no longer active (reaching unmaskoperation is independent of INTERRUPT mode). This does notprevent RPS operation from resuming on the next unpark.In interrupt mode, intel_rps_unpark() callsrps_enable_interrupts(), which enables and unmasks the PMinterrupts. In timer mode, it calls rps_start_timer(),restarting periodic engine-busyness evaluation. The timergenerates software RPS events and queues rps_work() directly,independently of PM interrupt delivery. Neither mode requiresthe late worker to unmask interrupts while the GT is parked\n(cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)\nhttps://www.cve.org/CVERecord?id=CVE-2026-99005https://git.kernel.org/stable/c/77abc1837c9651c8f43f7f7f336d10093eeb7745https://git.kernel.org/stable/c/60f58da15f8c8e39706c564f9251de3626636dcehttps://git.kernel.org/stable/c/0b4a0fb98b9ffeac36798bbd369c821605cae70fhttps://git.kernel.org/stable/c/49d349c42cf5ebaa878d02699c632c9d883d935fhttps://git.kernel.org/stable/c/5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb#kernel #Linux#CVE_2026_99005#bot", "url": "https://infosec.exchange/users/cve/statuses/117490516631480787"}, {"timestamp": "2026-10-23T15:31:34Z", "date_only": false, "value": "2026-10-23T15:31:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VCPF-23W8-Q6WV", "record": "GHSA-VCPF-23W8-Q6WV", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T15:31:34Z", "date_only": false, "value": "2026-10-23T15:31:34Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VCPF-23W8-Q6WV", "record": "GHSA-VCPF-23W8-Q6WV", "field": "modified"}, {"timestamp": "2026-10-25T01:03:09Z", "date_only": false, "value": "2026-10-25T01:03:09.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99005", "record": "MSRC_CVE-2026-99005", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-25T01:03:09Z", "date_only": false, "value": "2026-10-25T01:03:09.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99005", "record": "MSRC_CVE-2026-99005", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-25T01:04:05Z", "date_only": false, "value": "2026-10-25T01:04:05.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99005", "record": "MSRC_CVE-2026-99005", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-25T01:04:05Z", "date_only": false, "value": "2026-10-25T01:04:05.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99005", "record": "MSRC_CVE-2026-99005", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-25T07:01:02.654Z", "date_only": false, "value": "2026-10-25T07:01:02.654Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99005", "record": "MSRC_CVE-2026-99005", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-28T06:07:55.552Z", "date_only": false, "value": "2026-10-28T06:07:55.55245Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99005", "record": "BELL-CVE-2026-99005", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T06:31:44.834Z", "date_only": false, "value": "2026-10-28T06:31:44.834322Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99005", "record": "BELL-CVE-2026-99005", "field": "modified"}, {"timestamp": "2026-10-28T23:52:01Z", "date_only": false, "value": "2026-10-28T23:52:01Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99005", "record": "UBUNTU-CVE-2026-99005", "field": "modified"}], "metrics": {"as_of": "2026-10-29T17:34:54.400Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:20:30.462Z", "date_only": false, "value": "2026-10-23T12:20:30.462Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-99005", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:20:30.462Z", "date_only": false, "value": "2026-10-23T12:20:30.462Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-99005", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 537263.938992, "hours": 149.23998305333333, "days": 6.218332627222222, "min_seconds": 537263.938992, "max_seconds": 537263.938992, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:20:30.462Z", "date_only": false, "value": "2026-10-23T12:20:30.462Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-99005", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T17:34:54.400Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}