{"metadata": {"vulnerability": "CVE-2026-99134", "count": 14, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-09-25T10:25:14.394Z", "date_only": false, "value": "2026-09-25T10:25:14.394Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99134", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99134", "record": "UBUNTU-CVE-2026-99134", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T10:34:47.193Z", "date_only": false, "value": "2026-10-28T10:34:47.193Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99134", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T11:06:46.679Z", "date_only": false, "value": "2026-10-28T11:06:46.679148Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117518211875657690", "record": "CVE-2026-99134", "field": "creation_timestamp", "uuid": "23e8c737-85f2-4e4c-b647-eb61a8234c40", "content": "CVE-2026-99134 mac802154: fix data race and NULL deref on local->assoc_dev In the Linux kernel, the following vulnerability has been resolved:\nmac802154: fix data race and NULL deref on local->assoc_dev\nlocal->assoc_dev is shared between the association path and theassociation-response worker without common synchronization.\nmac802154_perform_association() stores the coordinator pointer and waitsfor a response. Its timeout and error paths clear the pointer and returnto mac802154_associate(), which may then free the coordinator object.Meanwhile, mac802154_rx_mac_cmd_worker() may observe the associating bitand enter mac802154_process_association_resp(), which dereferencesassoc_dev.\nThe worker's bit test and the handler's pointer dereference are notatomic with respect to cleanup. Cleanup can clear assoc_dev between them,causing a NULL dereference, or free the coordinator while the responsehandler still uses the pointer.\nThe recorded result is exposed to the same window. assoc_status andassoc_addr are written by the handler but read by the association pathwhile the associating bit is still set, so a second response for the samerequest - a malicious one, for instance - can replace them between thosereads and leave the caller with an incoherent status and address pair.\nThe response handler only needs the coordinator extended address.Replace assoc_dev with a cached address, removing the pointer lifetimedependency. Protect the cached address and the associating bit with adedicated spinlock. A READ_ONCE()/WRITE_ONCE() pair would not guaranteean atomic __le64 access on all 32-bit architectures.\nwpan_dev->association_lock cannot be reused here: nl802154_associate()holds it across rdev_associate(), hence for the whole ofmac802154_perform_association() including the wait for the response.A response handler taking that lock would only get it once theassociation has already given up.\nReset the completion, publish the cached address, and set the associatingbit while holding the lock. The response handler takes the lock, rechecksthe bit and the cached address, records the response, clears the bit, andonly then completes the waiter. Thus cleanup cannot pass the handlerbetween its state check and completion, and the cached 64-bit valuecannot tear.\nThe handler clears the bit before completing, not the woken waiter:otherwise complete() is issued under the lock and a second (e.g.malicious) response can reacquire it before the waiter and replace theresult. So a wait that returns success implies the bit is already clear,and the success and negative-response paths return directly. Thetransmit-error and timeout paths still clear it under assoc_lock, whichserializes any racing response against the cleanup while the call returnsthe error it already selected. Both paths snapshot assoc_status andassoc_addr under the same lock.\nBoth users run in process context, so a plain spinlock is sufficient.The lock is not held while waiting for the completion.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99134https://git.kernel.org/stable/c/3cdd8b1abddebbae2582e90294c77b61d5f5aee7https://git.kernel.org/stable/c/a585901bb8cd2cd60d678be8a56ca6a4e1a6946chttps://git.kernel.org/stable/c/c037915f80c4db47f7d061d68e703ffd551b1a34#kernel #Linux#CVE_2026_99134#bot", "url": "https://infosec.exchange/users/cve/statuses/117518211875657690"}, {"timestamp": "2026-10-28T11:17:33Z", "date_only": false, "value": "2026-10-28T11:17:33Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JX9P-6HJG-J64X", "record": "GHSA-JX9P-6HJG-J64X", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-28T11:17:33.260Z", "date_only": false, "value": "2026-10-28T11:17:33.260", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99134", "record": "FKIE_CVE-2026-99134", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T12:31:04Z", "date_only": false, "value": "2026-10-28T12:31:04Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JX9P-6HJG-J64X", "record": "GHSA-JX9P-6HJG-J64X", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:08:45.722Z", "date_only": false, "value": "2026-10-30T06:08:45.722947Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99134", "record": "BELL-CVE-2026-99134", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:30:36Z", "date_only": false, "value": "2026-10-30T06:30:36Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99134", "record": "UBUNTU-CVE-2026-99134", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T12:42:07.557Z", "date_only": false, "value": "2026-10-30T12:42:07.557Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99134", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T12:42:07.557Z", "date_only": false, "value": "2026-10-30T12:42:07.557Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99134", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T13:21:47.633Z", "date_only": false, "value": "2026-10-30T13:21:47.633", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99134", "record": "FKIE_CVE-2026-99134", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-30T15:34:23Z", "date_only": false, "value": "2026-10-30T15:34:23Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JX9P-6HJG-J64X", "record": "GHSA-JX9P-6HJG-J64X", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T06:24:02.851Z", "date_only": false, "value": "2026-11-03T06:24:02.851063Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99134", "record": "BELL-CVE-2026-99134", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-05T11:31:25.109Z", "anchors": {"origin": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99134", "record": "UBUNTU-CVE-2026-99134", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99134", "record": "UBUNTU-CVE-2026-99134", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 732685.109275, "hours": 203.5236414652778, "days": 8.480151727719909, "min_seconds": 646285.109275, "max_seconds": 732685.109275, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99134", "record": "UBUNTU-CVE-2026-99134", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-05T11:31:25.109Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}