{"metadata": {"vulnerability": "CVE-2026-99085", "count": 18, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-25T10:25:14.390Z", "date_only": false, "value": "2026-09-25T10:25:14.390Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99085", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:45:03.465Z", "date_only": false, "value": "2026-10-23T12:45:03.465Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99085", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T12:45:03.465Z", "date_only": false, "value": "2026-10-23T12:45:03.465Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99085", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T12:45:03.465Z", "date_only": false, "value": "2026-10-23T12:45:03.465Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99085", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99085", "record": "UBUNTU-CVE-2026-99085", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:32Z", "date_only": false, "value": "2026-10-23T13:17:32Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7QJF-QV2C-RR8M", "record": "GHSA-7QJF-QV2C-RR8M", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-23T13:17:32.803Z", "date_only": false, "value": "2026-10-23T13:17:32.803", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99085", "record": "FKIE_CVE-2026-99085", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:32.803Z", "date_only": false, "value": "2026-10-23T13:17:32.803", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99085", "record": "FKIE_CVE-2026-99085", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-23T14:39:20.202Z", "date_only": false, "value": "2026-10-23T14:39:20.202085Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490736136279007", "record": "CVE-2026-99085", "field": "creation_timestamp", "uuid": "a6e53a00-01ce-4150-951e-03b283f47d7b", "content": "CVE-2026-99085 sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler In the Linux kernel, the following vulnerability has been resolved:\nsched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler\nA CPU going down has to empty its own rq. Its hotplug thread waits insched_cpu_wait_empty() until nothing else is left, and the only thing thatwakes it is balance_push(), which runs from __schedule() on the dying CPUand pushes off the migratable tasks the CPU picks.\nsched_ext breaks this. A task sitting on a user DSQ or held by the BPFscheduler is still counted on its rq, but an inactive CPU no longer callsops.dispatch() and can't pull the task back. The dying CPU goes idle withthe task still counted, and one of two things happens:\n- Another CPU consumes the task. The rq empties without a __schedule() on  the dying CPU, so the hotplug thread is never woken and cpu_down() hangs  holding cpu_hotplug_lock.- The task is affine only to the dying CPU. Nothing can move it, and the  offline stalls until the watchdog ejects the BPF scheduler.\nWhen the rq goes offline, re-enqueue every task on it that isn't already onthe local DSQ. An enqueue on an offline rq lands on the local DSQ, so thedying CPU itself picks the tasks and balance_push() pushes them off, thesame as for the other sched classes. From then on no sched_ext path onanother CPU can pull a task off the rq.\nops.dispatch() currently stops as soon as the CPU goes inactive, and CPUhotplug then waits for an RCU grace period before taking the rq offline. ABPF-held task affine only to the dying CPU and preempted inside an RCUread-side critical section would block that grace period, and the rq wouldnever go offline. Test SCX_RQ_ONLINE directly so that ops.dispatch() keepsrunning until the rq goes offline. Only the dying CPU's own hotplug threadclears the flag during teardown, and task_can_run_on_remote_rq() still keepsother rqs' tasks off the CPU.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99085https://git.kernel.org/stable/c/f79cd7a2df3768323fbfb9b0f96adff08fb7eb4chttps://git.kernel.org/stable/c/638ee6bca19750934ea13f9c325f46fd8ae60064https://git.kernel.org/stable/c/173ff9d03ec6373c3158b6e630af33a9b36fd216https://git.kernel.org/stable/c/d35a535d3e3e71f92a051d94e415f43612c4edfc#kernel #Linux#CVE_2026_99085#bot", "url": "https://infosec.exchange/users/cve/statuses/117490736136279007"}, {"timestamp": "2026-10-23T15:31:37Z", "date_only": false, "value": "2026-10-23T15:31:37Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7QJF-QV2C-RR8M", "record": "GHSA-7QJF-QV2C-RR8M", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T15:31:37Z", "date_only": false, "value": "2026-10-23T15:31:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7QJF-QV2C-RR8M", "record": "GHSA-7QJF-QV2C-RR8M", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-25T01:07:03Z", "date_only": false, "value": "2026-10-25T01:07:03.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99085", "record": "MSRC_CVE-2026-99085", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-25T01:07:03Z", "date_only": false, "value": "2026-10-25T01:07:03.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99085", "record": "MSRC_CVE-2026-99085", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T01:07:03Z", "date_only": false, "value": "2026-10-25T01:07:03.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99085", "record": "MSRC_CVE-2026-99085", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-10-25T07:01:02.659Z", "date_only": false, "value": "2026-10-25T07:01:02.659Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99085", "record": "MSRC_CVE-2026-99085", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-10-28T06:07:59.828Z", "date_only": false, "value": "2026-10-28T06:07:59.828252Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99085", "record": "BELL-CVE-2026-99085", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:30:27Z", "date_only": false, "value": "2026-10-30T06:30:27Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99085", "record": "UBUNTU-CVE-2026-99085", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T06:24:00.734Z", "date_only": false, "value": "2026-11-03T06:24:00.734448Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99085", "record": "BELL-CVE-2026-99085", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-05T01:26:18.079Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:45:03.465Z", "date_only": false, "value": "2026-10-23T12:45:03.465Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99085", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:45:03.465Z", "date_only": false, "value": "2026-10-23T12:45:03.465Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99085", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1082474.614992, "hours": 300.6873930533333, "days": 12.528641377222222, "min_seconds": 1082474.614992, "max_seconds": 1082474.614992, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:45:03.465Z", "date_only": false, "value": "2026-10-23T12:45:03.465Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99085", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-05T01:26:18.079Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}