{"metadata": {"vulnerability": "CVE-2026-99019", "count": 21, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 13}}, "data": [{"timestamp": "2026-09-25T10:25:14.386Z", "date_only": false, "value": "2026-09-25T10:25:14.386Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99019", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:20:55.832Z", "date_only": false, "value": "2026-10-23T12:20:55.832Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99019", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99019", "record": "UBUNTU-CVE-2026-99019", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:24Z", "date_only": false, "value": "2026-10-23T13:17:24Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3XF5-26FR-5WMR", "record": "GHSA-3XF5-26FR-5WMR", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-23T13:17:24.770Z", "date_only": false, "value": "2026-10-23T13:17:24.770", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99019", "record": "FKIE_CVE-2026-99019", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:52:55.759Z", "date_only": false, "value": "2026-10-23T13:52:55.759971Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490553658622502", "record": "CVE-2026-99019", "field": "creation_timestamp", "uuid": "ca7b636b-edfa-41be-906f-433eff058b32", "content": "CVE-2026-99019 scsi: ch: Do not keep references to data transfer element devices In the Linux kernel, the following vulnerability has been resolved:\nscsi: ch: Do not keep references to data transfer element devices\nch_readconfig() looks up the scsi_device of every data transfer elementwhose SCSI id the changer reports in READ ELEMENT STATUS, and stores it inch->dt[]. scsi_device_lookup() takes a reference, and nothing ever dropsit: ch_destroy() frees the array with kfree(). ch->dt[] is read nowhereelse - it only supplies the vendor, model and revision printed in the sameloop.\nOnce such a drive is removed, its scsi_device can never be released. Itstays on the host's device list at its address, so a new device there isrefused by anything that walks the list - target_core_pscsi reports\"scsi_device_get() failed for H:C:T:L\" - and the low-level driver's modulecan no longer be unloaded. Only a reboot recovers.\nIt shows with any changer that reports its drives' ids; with the mhvtlvirtual library (IBM 3573-TL personality), each create and remove of alibrary with four drives leaves four references behind, counted by themodule's use count in lsmod. With ch not bound the count is unchanged, andwith this patch applied it is unchanged too.\nDrop the reference as soon as the name has been printed, and remove the nowunused dt[] array. That also removes the array leaked when ch_probe() failsafter ch_readconfig().\nThe same leak was reported with an RFC patch in 2022, which was not merged.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99019https://git.kernel.org/stable/c/ec6ecab1b7577ae555ee6b81480814d123dd9ec0https://git.kernel.org/stable/c/cef2cedb6f7a394b278775b3d6ffb9b20ecd61dbhttps://git.kernel.org/stable/c/a34a230ccea1b8b667ae59dca11295a2c8f81738https://git.kernel.org/stable/c/1d35a17f1c2ed4154731895694a1a3557f0da766https://git.kernel.org/stable/c/27c0f718d3b3c99e6d315308e95d987d0382a8a8#kernel #Linux#CVE_2026_99019#bot", "url": "https://infosec.exchange/users/cve/statuses/117490553658622502"}, {"timestamp": "2026-10-23T15:31:35Z", "date_only": false, "value": "2026-10-23T15:31:35Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3XF5-26FR-5WMR", "record": "GHSA-3XF5-26FR-5WMR", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T01:03:31Z", "date_only": false, "value": "2026-10-25T01:03:31.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99019", "record": "MSRC_CVE-2026-99019", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-25T01:03:31Z", "date_only": false, "value": "2026-10-25T01:03:31.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99019", "record": "MSRC_CVE-2026-99019", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T01:04:42Z", "date_only": false, "value": "2026-10-25T01:04:42.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99019", "record": "MSRC_CVE-2026-99019", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-26T14:46:27Z", "date_only": false, "value": "2026-10-26T14:46:27.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99019", "record": "MSRC_CVE-2026-99019", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-10-28T01:49:57Z", "date_only": false, "value": "2026-10-28T01:49:57.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99019", "record": "MSRC_CVE-2026-99019", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-10-28T01:49:57Z", "date_only": false, "value": "2026-10-28T01:49:57.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99019", "record": "MSRC_CVE-2026-99019", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-10-28T06:07:55.882Z", "date_only": false, "value": "2026-10-28T06:07:55.882228Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99019", "record": "BELL-CVE-2026-99019", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T07:02:50.897Z", "date_only": false, "value": "2026-10-28T07:02:50.897Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99019", "record": "MSRC_CVE-2026-99019", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-10-30T12:40:58.753Z", "date_only": false, "value": "2026-10-30T12:40:58.753Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99019", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T12:40:58.753Z", "date_only": false, "value": "2026-10-30T12:40:58.753Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99019", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T13:21:37.843Z", "date_only": false, "value": "2026-10-30T13:21:37.843", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99019", "record": "FKIE_CVE-2026-99019", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-30T15:34:15Z", "date_only": false, "value": "2026-10-30T15:34:15Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3XF5-26FR-5WMR", "record": "GHSA-3XF5-26FR-5WMR", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T19:03:33Z", "date_only": false, "value": "2026-10-30T19:03:33Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99019", "record": "UBUNTU-CVE-2026-99019", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T20:04:08.307Z", "date_only": false, "value": "2026-11-03T20:04:08.307356Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99019", "record": "BELL-CVE-2026-99019", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-05T09:16:26.338Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:20:55.832Z", "date_only": false, "value": "2026-10-23T12:20:55.832Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99019", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:20:55.832Z", "date_only": false, "value": "2026-10-23T12:20:55.832Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99019", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1112130.506966, "hours": 308.92514082388885, "days": 12.871880867662037, "min_seconds": 1112130.506966, "max_seconds": 1112130.506966, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:20:55.832Z", "date_only": false, "value": "2026-10-23T12:20:55.832Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99019", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-05T09:16:26.338Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}