{"metadata": {"vulnerability": "CVE-2026-98906", "count": 21, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 13}}, "data": [{"timestamp": "2026-09-25T10:25:14.379Z", "date_only": false, "value": "2026-09-25T10:25:14.379Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-98906", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T11:54:42.697Z", "date_only": false, "value": "2026-10-23T11:54:42.697Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98906", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T12:18:00Z", "date_only": false, "value": "2026-10-23T12:18:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98906", "record": "UBUNTU-CVE-2026-98906", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T12:18:24Z", "date_only": false, "value": "2026-10-23T12:18:24Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-2FW9-6RFH-9Q85", "record": "GHSA-2FW9-6RFH-9Q85", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-23T12:18:24.680Z", "date_only": false, "value": "2026-10-23T12:18:24.680", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98906", "record": "FKIE_CVE-2026-98906", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T12:26:09.594Z", "date_only": false, "value": "2026-10-23T12:26:09.594786Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490212475509767", "record": "CVE-2026-98906", "field": "creation_timestamp", "uuid": "3e632f56-22d7-4d29-845a-37b2c5b4d52b", "content": "CVE-2026-98906 net: lan966x: restore RX state on reload failure In the Linux kernel, the following vulnerability has been resolved:\nnet: lan966x: restore RX state on reload failure\nlan966x_fdma_reload() backs up rx->page_pool and rx->fdma beforereallocating the RX resources for the new MTU. If the allocation fails,the restore path puts these fields back before restarting RX.\nHowever, the reload path also updates rx->page_order and rx->max_mtubefore calling lan966x_fdma_rx_alloc(). These fields are not restored onfailure, so RX can be restarted with the old pages, old FDMA state andold page pool, but with the page geometry from the failed new MTU.\nThis can make the XDP path advertise a frame size derived from the newpage_order while the actual RX pages still come from the old allocation.For example, after a failed reload to a jumbo MTU, xdp_init_buff() may becalled with a frame size larger than the restored RX pages.\nlan966x_fdma_rx_alloc_page_pool() also registers the newly allocated pagepool with each port's XDP RXQ before fdma_alloc_coherent() is called. Iffdma_alloc_coherent() fails, the new page pool is destroyed, but therollback path does not restore the per-port XDP RXQ mem modelregistration either.\nSave and restore rx->page_order and rx->max_mtu, and restore the old pagepool registration for each port's XDP RXQ before RX is started again.This keeps the restored RX state consistent after a failed reload.\nhttps://www.cve.org/CVERecord?id=CVE-2026-98906https://git.kernel.org/stable/c/3883898ddc26308497dbba8068951ab5eddbd111https://git.kernel.org/stable/c/b5a6462f4646687c922931133a2478da94addc87https://git.kernel.org/stable/c/aa97f11a76e545ed73cc455bcdd1ece4b480b507#kernel #Linux#CVE_2026_98906#bot", "url": "https://infosec.exchange/users/cve/statuses/117490212475509767"}, {"timestamp": "2026-10-23T12:31:37Z", "date_only": false, "value": "2026-10-23T12:31:37Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2FW9-6RFH-9Q85", "record": "GHSA-2FW9-6RFH-9Q85", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T12:31:37Z", "date_only": false, "value": "2026-10-23T12:31:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2FW9-6RFH-9Q85", "record": "GHSA-2FW9-6RFH-9Q85", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-24T01:02:35Z", "date_only": false, "value": "2026-10-24T01:02:35.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98906", "record": "MSRC_CVE-2026-98906", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-24T01:02:35Z", "date_only": false, "value": "2026-10-24T01:02:35.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98906", "record": "MSRC_CVE-2026-98906", "field": "vulnerabilities.0.remediations.0.date", "linked_record": true}, {"timestamp": "2026-10-24T01:02:35Z", "date_only": false, "value": "2026-10-24T01:02:35.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98906", "record": "MSRC_CVE-2026-98906", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-24T01:05:56Z", "date_only": false, "value": "2026-10-24T01:05:56.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98906", "record": "MSRC_CVE-2026-98906", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-26T06:56:35.317Z", "date_only": false, "value": "2026-10-26T06:56:35.317Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-98906", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-26T06:56:35.317Z", "date_only": false, "value": "2026-10-26T06:56:35.317Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-98906", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-26T07:17:15.960Z", "date_only": false, "value": "2026-10-26T07:17:15.960", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98906", "record": "FKIE_CVE-2026-98906", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-28T06:07:48.873Z", "date_only": false, "value": "2026-10-28T06:07:48.873144Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98906", "record": "BELL-CVE-2026-98906", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T06:31:38.170Z", "date_only": false, "value": "2026-10-28T06:31:38.170955Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98906", "record": "BELL-CVE-2026-98906", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-01T15:00:17Z", "date_only": false, "value": "2026-11-01T15:00:17.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98906", "record": "MSRC_CVE-2026-98906", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-01T15:00:17Z", "date_only": false, "value": "2026-11-01T15:00:17.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98906", "record": "MSRC_CVE-2026-98906", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-02T08:02:48.169Z", "date_only": false, "value": "2026-11-02T08:02:48.169Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98906", "record": "MSRC_CVE-2026-98906", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-03T18:15:40Z", "date_only": false, "value": "2026-11-03T18:15:40Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98906", "record": "UBUNTU-CVE-2026-98906", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-05T23:09:38.095Z", "anchors": {"origin": {"timestamp": "2026-10-23T11:54:42.697Z", "date_only": false, "value": "2026-10-23T11:54:42.697Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98906", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T11:54:42.697Z", "date_only": false, "value": "2026-10-23T11:54:42.697Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98906", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1163695.398053, "hours": 323.2487216813889, "days": 13.468696736724537, "min_seconds": 1163695.398053, "max_seconds": 1163695.398053, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T11:54:42.697Z", "date_only": false, "value": "2026-10-23T11:54:42.697Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98906", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-05T23:09:38.095Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}