{"metadata": {"vulnerability": "CVE-2026-99076", "count": 22, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 14}}, "data": [{"timestamp": "2026-09-25T10:25:14.389Z", "date_only": false, "value": "2026-09-25T10:25:14.389Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99076", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:23:19.727Z", "date_only": false, "value": "2026-10-23T12:23:19.727Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99076", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T12:23:19.727Z", "date_only": false, "value": "2026-10-23T12:23:19.727Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99076", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T12:23:19.727Z", "date_only": false, "value": "2026-10-23T12:23:19.727Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99076", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99076", "record": "UBUNTU-CVE-2026-99076", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:31Z", "date_only": false, "value": "2026-10-23T13:17:31Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-R224-867J-VFXF", "record": "GHSA-R224-867J-VFXF", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-23T13:17:31.663Z", "date_only": false, "value": "2026-10-23T13:17:31.663", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99076", "record": "FKIE_CVE-2026-99076", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:31.663Z", "date_only": false, "value": "2026-10-23T13:17:31.663", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99076", "record": "FKIE_CVE-2026-99076", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-23T14:31:15.877Z", "date_only": false, "value": "2026-10-23T14:31:15.877919Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490704410218081", "record": "CVE-2026-99076", "field": "creation_timestamp", "uuid": "679feb94-7c04-4f08-84c5-92d1bb481062", "content": "CVE-2026-99076 ipv6: udp: Create exceptions before socket matching In the Linux kernel, the following vulnerability has been resolved:\nipv6: udp: Create exceptions before socket matching\nCurrently, when ICMPv6 Packet Too Big and Redirect Message packets arelocally delivered and quote a UDP packet, an exception is only createdin the IPv6 exception cache if the kernel can match the UDP packet to anexisting socket.\nThis behavior allows off-path attackers to conduct a side-channel attackon the exception cache in order to discover the ephemeral port used by aconnected UDP socket.\nCommit 4785305c05b2 (\"ipv6: use siphash in rt6_exception_hash()\") andcommit a00df2caffed (\"ipv6: make exception cache less predictible\") triedto mitigate such attacks by making it harder for attackers to discoverhash collisions in the exception cache and by randomizing the number ofexceptions a hash bucket can hold, respectively. Unfortunately, both ofthe mitigations can be bypassed.\nInstead, mitigate such attacks by always creating an exception, evenbefore trying to find a matching socket. Do that by callingip6_update_pmtu() and ip6_redirect(), the helpers used when the quotedpacket did not originate from a socket.\nThis means that guesses (right or wrong) from an off-path attacker willalways result in an exception being created or updated in the cache thatthe attacker can observe.\nPass the ifindex of the ingress device and the default uid, in a similarfashion to icmpv6_err(). Unlike IPv4, an oif of 0 would not match anynexthop in ip6_redirect_nh_match() and no exception would be created inresponse to a Redirect Message.\nNote that this does not allow attackers to create exceptions that theycould not create before, as both helpers can already be reached withlittle to no validation. For example, by sending an ICMPv6 error thatquotes an ICMPv6 Echo Reply or one that quotes a UDP source port thatmatches a wildcard socket.\nAlso note that in the good case (matched socket) the above scheme comesat the cost of an extra route lookup, as the no socket helpers performtheir own lookup before the one performed by ip6_sk_update_pmtu() /ip6_sk_redirect(). When the two resolve to different nexthops, it alsoresults in two exceptions being created for the same destination IP. Onein the exception cache of the nexthop resolved by the no socket helpersand another in the exception cache of the nexthop used by the socket.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99076https://git.kernel.org/stable/c/8c9b310c958be33ba8fb9d0e6b77811d013e10c0https://git.kernel.org/stable/c/ac76cab50e899a7346408b8d3c3a4192c2eefb9f#kernel #Linux#CVE_2026_99076#bot", "url": "https://infosec.exchange/users/cve/statuses/117490704410218081"}, {"timestamp": "2026-10-23T15:31:37Z", "date_only": false, "value": "2026-10-23T15:31:37Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-R224-867J-VFXF", "record": "GHSA-R224-867J-VFXF", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T15:31:37Z", "date_only": false, "value": "2026-10-23T15:31:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-R224-867J-VFXF", "record": "GHSA-R224-867J-VFXF", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-25T01:05:11Z", "date_only": false, "value": "2026-10-25T01:05:11.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99076", "record": "MSRC_CVE-2026-99076", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-25T01:05:11Z", "date_only": false, "value": "2026-10-25T01:05:11.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99076", "record": "MSRC_CVE-2026-99076", "field": "vulnerabilities.0.remediations.0.date", "linked_record": true}, {"timestamp": "2026-10-25T01:05:11Z", "date_only": false, "value": "2026-10-25T01:05:11.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99076", "record": "MSRC_CVE-2026-99076", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T01:06:36Z", "date_only": false, "value": "2026-10-25T01:06:36.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99076", "record": "MSRC_CVE-2026-99076", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-26T14:48:50Z", "date_only": false, "value": "2026-10-26T14:48:50.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99076", "record": "MSRC_CVE-2026-99076", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-10-28T06:07:59.282Z", "date_only": false, "value": "2026-10-28T06:07:59.282504Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99076", "record": "BELL-CVE-2026-99076", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T06:31:49.652Z", "date_only": false, "value": "2026-10-28T06:31:49.652886Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99076", "record": "BELL-CVE-2026-99076", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T19:03:44Z", "date_only": false, "value": "2026-10-30T19:03:44Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99076", "record": "UBUNTU-CVE-2026-99076", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-01T15:06:10Z", "date_only": false, "value": "2026-11-01T15:06:10.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99076", "record": "MSRC_CVE-2026-99076", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-11-01T15:06:10Z", "date_only": false, "value": "2026-11-01T15:06:10.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99076", "record": "MSRC_CVE-2026-99076", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-02T08:02:48.180Z", "date_only": false, "value": "2026-11-02T08:02:48.180Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99076", "record": "MSRC_CVE-2026-99076", "field": "document.tracking.generator.date", "linked_record": true}], "metrics": {"as_of": "2026-11-06T07:45:16.348Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:23:19.727Z", "date_only": false, "value": "2026-10-23T12:23:19.727Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99076", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:23:19.727Z", "date_only": false, "value": "2026-10-23T12:23:19.727Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99076", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1192916.621921, "hours": 331.3657283113889, "days": 13.806905346307872, "min_seconds": 1192916.621921, "max_seconds": 1192916.621921, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:23:19.727Z", "date_only": false, "value": "2026-10-23T12:23:19.727Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99076", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-06T07:45:16.348Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}