{"metadata": {"vulnerability": "CVE-2026-99028", "count": 18, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-25T10:25:14.386Z", "date_only": false, "value": "2026-09-25T10:25:14.386Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99028", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:21:20.294Z", "date_only": false, "value": "2026-10-23T12:21:20.294Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99028", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T12:21:20.294Z", "date_only": false, "value": "2026-10-23T12:21:20.294Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99028", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T12:21:20.294Z", "date_only": false, "value": "2026-10-23T12:21:20.294Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99028", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99028", "record": "UBUNTU-CVE-2026-99028", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:25Z", "date_only": false, "value": "2026-10-23T13:17:25Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-5XGG-2G43-R4GH", "record": "GHSA-5XGG-2G43-R4GH", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-23T13:17:25.843Z", "date_only": false, "value": "2026-10-23T13:17:25.843", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99028", "record": "FKIE_CVE-2026-99028", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:25.843Z", "date_only": false, "value": "2026-10-23T13:17:25.843", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99028", "record": "FKIE_CVE-2026-99028", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-23T13:58:58.832Z", "date_only": false, "value": "2026-10-23T13:58:58.832911Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490577459365237", "record": "CVE-2026-99028", "field": "creation_timestamp", "uuid": "fbc593d0-a0a2-43d4-8d55-e4afe0d9df9f", "content": "CVE-2026-99028 net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the Linux kernel, the following vulnerability has been resolved:\nnet: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop\nIn the dmaengine path the driver pre-submits RX buffers and holdsin-flight TX buffers whose SKBs are DMA-mapped by the driver and freedonly in the completion callbacks. On ndo_stop() dmaengine_terminate_sync()aborts these descriptors without running their callbacks, and the driverthen frees only the ring shells, leaking every SKB still owned by theengine and its DMA mapping on each ifdown. With 128 RX buffers pre-postedper channel, the mapping leak can eventually exhaust a limited IOMMUaperture.\nClear the slot's skb in the TX and RX callbacks so a non-NULL skb marks aslot that still owns a live, DMA-mapped buffer, and on stop unmap and freeevery such buffer.\naxienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring oneach completion, so it can race axienet_stop(): a completion may submit afresh buffer after dmaengine_terminate_sync() has returned, leaving thechannel armed with a buffer the teardown then frees while the engine maystill write into it (dma_release_channel() does not stop it either). Add alock that axienet_dma_rx_cb() holds across the @stopping check and theresubmit, and axienet_stop() holds to set @stopping before terminating.Once @stopping is set no callback can arm a new buffer, and any armed justbefore is aborted by the terminate, so teardown only frees buffers theengine no longer owns.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99028https://git.kernel.org/stable/c/079396129da5e7cb40ca0920aa1b9525bef6097chttps://git.kernel.org/stable/c/eececf7c3a679d9c08175ad6bacbc8c31848f5afhttps://git.kernel.org/stable/c/5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58https://git.kernel.org/stable/c/bcf2573a68a808a5b54cadafa72b6672e662c2bf#kernel #Linux#CVE_2026_99028#bot", "url": "https://infosec.exchange/users/cve/statuses/117490577459365237"}, {"timestamp": "2026-10-23T15:31:35Z", "date_only": false, "value": "2026-10-23T15:31:35Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5XGG-2G43-R4GH", "record": "GHSA-5XGG-2G43-R4GH", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T15:31:35Z", "date_only": false, "value": "2026-10-23T15:31:35Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5XGG-2G43-R4GH", "record": "GHSA-5XGG-2G43-R4GH", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-25T01:04:58Z", "date_only": false, "value": "2026-10-25T01:04:58.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99028", "record": "MSRC_CVE-2026-99028", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-25T01:04:58Z", "date_only": false, "value": "2026-10-25T01:04:58.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99028", "record": "MSRC_CVE-2026-99028", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T01:04:58Z", "date_only": false, "value": "2026-10-25T01:04:58.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99028", "record": "MSRC_CVE-2026-99028", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-10-25T07:01:02.658Z", "date_only": false, "value": "2026-10-25T07:01:02.658Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99028", "record": "MSRC_CVE-2026-99028", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-10-28T06:07:56.414Z", "date_only": false, "value": "2026-10-28T06:07:56.414584Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99028", "record": "BELL-CVE-2026-99028", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:30:16Z", "date_only": false, "value": "2026-10-30T06:30:16Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99028", "record": "UBUNTU-CVE-2026-99028", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T06:23:57.591Z", "date_only": false, "value": "2026-11-03T06:23:57.591331Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99028", "record": "BELL-CVE-2026-99028", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-04T21:26:01.231Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:21:20.294Z", "date_only": false, "value": "2026-10-23T12:21:20.294Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99028", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:21:20.294Z", "date_only": false, "value": "2026-10-23T12:21:20.294Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99028", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1069480.937063, "hours": 297.07803807305555, "days": 12.378251586377313, "min_seconds": 1069480.937063, "max_seconds": 1069480.937063, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:21:20.294Z", "date_only": false, "value": "2026-10-23T12:21:20.294Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99028", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-04T21:26:01.231Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}