{"metadata": {"vulnerability": "CVE-2026-99001", "count": 18, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-25T10:25:14.385Z", "date_only": false, "value": "2026-09-25T10:25:14.385Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99001", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:20:21.753Z", "date_only": false, "value": "2026-10-23T12:20:21.753Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99001", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T12:20:21.753Z", "date_only": false, "value": "2026-10-23T12:20:21.753Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99001", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T12:20:21.753Z", "date_only": false, "value": "2026-10-23T12:20:21.753Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99001", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99001", "record": "UBUNTU-CVE-2026-99001", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:17:22Z", "date_only": false, "value": "2026-10-23T13:17:22Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FX73-8C7H-M232", "record": "GHSA-FX73-8C7H-M232", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-23T13:17:22.440Z", "date_only": false, "value": "2026-10-23T13:17:22.440", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99001", "record": "FKIE_CVE-2026-99001", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:17:22.440Z", "date_only": false, "value": "2026-10-23T13:17:22.440", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99001", "record": "FKIE_CVE-2026-99001", "field": "lastModified"}, {"timestamp": "2026-10-23T13:40:49.325Z", "date_only": false, "value": "2026-10-23T13:40:49.325043Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490506059315747", "record": "CVE-2026-99001", "field": "creation_timestamp", "uuid": "415e1a46-888d-4e56-9e81-62c2f74e5a31", "content": "CVE-2026-99001 drm/xe/i2c: cancel the client work on remove In the Linux kernel, the following vulnerability has been resolved:\ndrm/xe/i2c: cancel the client work on remove\nxe_i2c_notifier() stores the DesignWare adapter in i2c->adapter andschedules i2c->work when the adapter is registered under the xe I2Cplatform device, and xe_i2c_client_work() then instantiates the AMCclient device on that adapter.\nxe_i2c_remove() tears down the AMC, unregisters the client devices,the bus notifier and the adapter platform device, but it never drainsi2c->work. A work item that is still queued or running when theadapter is unregistered dereferences i2c->adapter ini2c_new_client_device() after platform_device_unregister() hasreleased the adapter. The work item is also embedded in thedevm-allocated struct xe_i2c, so a work item still queued after thedrm device devm unwind frees that allocation runs its callback onfreed memory.\nThe bus notifier is the only thing that schedules this work, and it isunregistered after the client devices. An instance that is still queuedwhen the teardown runs can therefore writei2c->client[XE_I2C_CLIENT_AMC] while the loop is unregistering andclearing the same array, and an AMC client it instantiates late is onlycleaned up by the adapter's own child sweep in i2c_del_adapter().\nMove bus_unregister_notifier() in front of the client teardown loopand cancel the work right after it, so no new instance can bescheduled and a queued instance is drained before the client array istouched. A running instance still finds a live adapter, since theadapter is unregistered later.\n(cherry picked from commit a23f27d5ec11c3f418c5e5531eea34ccda2b5b20)\nhttps://www.cve.org/CVERecord?id=CVE-2026-99001https://git.kernel.org/stable/c/2efa187fd4c9b8d7edcae0c1acf46739ce39fd01https://git.kernel.org/stable/c/175d654cd48320ad52d0f82dc3f4e3c063c3c5cahttps://git.kernel.org/stable/c/611857adc9e7b0ee1239a0baf38498922ca5a12e#kernel #Linux#CVE_2026_99001#bot", "url": "https://infosec.exchange/users/cve/statuses/117490506059315747"}, {"timestamp": "2026-10-23T15:31:34Z", "date_only": false, "value": "2026-10-23T15:31:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FX73-8C7H-M232", "record": "GHSA-FX73-8C7H-M232", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T15:31:34Z", "date_only": false, "value": "2026-10-23T15:31:34Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FX73-8C7H-M232", "record": "GHSA-FX73-8C7H-M232", "field": "modified"}, {"timestamp": "2026-10-26T01:04:24Z", "date_only": false, "value": "2026-10-26T01:04:24.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99001", "record": "MSRC_CVE-2026-99001", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-26T01:04:24Z", "date_only": false, "value": "2026-10-26T01:04:24.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99001", "record": "MSRC_CVE-2026-99001", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-26T01:04:24Z", "date_only": false, "value": "2026-10-26T01:04:24.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99001", "record": "MSRC_CVE-2026-99001", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-26T07:00:42.602Z", "date_only": false, "value": "2026-10-26T07:00:42.602Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99001", "record": "MSRC_CVE-2026-99001", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-28T06:07:54.815Z", "date_only": false, "value": "2026-10-28T06:07:54.815824Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99001", "record": "BELL-CVE-2026-99001", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T06:31:44.562Z", "date_only": false, "value": "2026-10-28T06:31:44.562425Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99001", "record": "BELL-CVE-2026-99001", "field": "modified"}, {"timestamp": "2026-10-28T17:50:05Z", "date_only": false, "value": "2026-10-28T17:50:05Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99001", "record": "UBUNTU-CVE-2026-99001", "field": "modified"}], "metrics": {"as_of": "2026-10-29T01:38:03.954Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:20:21.753Z", "date_only": false, "value": "2026-10-23T12:20:21.753Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99001", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:20:21.753Z", "date_only": false, "value": "2026-10-23T12:20:21.753Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99001", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 479862.201716, "hours": 133.29505603222222, "days": 5.5539606680092595, "min_seconds": 479862.201716, "max_seconds": 479862.201716, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:20:21.753Z", "date_only": false, "value": "2026-10-23T12:20:21.753Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99001", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T01:38:03.954Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}