{"metadata": {"vulnerability": "CVE-2026-99165", "count": 20, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 12}}, "data": [{"timestamp": "2026-09-25T10:25:14.398Z", "date_only": false, "value": "2026-09-25T10:25:14.398Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99165", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99165", "record": "UBUNTU-CVE-2026-99165", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T10:35:17.366Z", "date_only": false, "value": "2026-10-28T10:35:17.366Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99165", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T11:17:36Z", "date_only": false, "value": "2026-10-28T11:17:36Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-H9P5-Q3G4-GM7M", "record": "GHSA-H9P5-Q3G4-GM7M", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-28T11:17:36.917Z", "date_only": false, "value": "2026-10-28T11:17:36.917", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99165", "record": "FKIE_CVE-2026-99165", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T11:27:44.825Z", "date_only": false, "value": "2026-10-28T11:27:44.825194Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117518293924913559", "record": "CVE-2026-99165", "field": "creation_timestamp", "uuid": "bfe0be87-993a-461d-890c-b6781f977037", "content": "CVE-2026-99165 sctp: revalidate output stream after association connect wait In the Linux kernel, the following vulnerability has been resolved:\nsctp: revalidate output stream after association connect wait\nWhen message interleaving is enabled, the first send waits for associationestablishment before building its data chunks.  The wait drops the socketlock, and handshake processing can reduce the output stream count to thepeer-advertised inbound stream count.  sctp_stream_init() then frees theextension of every removed stream.\nThe sender resumes with the stream that it checked before the wait.  If thepeer removed that stream, sctp_outq_tail() later dereferences its NULLextension.  Fatal-oops policies then panic the host.\nKASAN: null-ptr-deref in range [0x38-0x3f]RIP: sctp_outq_tail+0x49e/0xaa0Call Trace: sctp_primitive_SEND sctp_sendmsg_to_asoc sctp_sendmsg\nA range check alone is insufficient.  Stream reconfiguration can grow theoutput count again while the lock is released without recreating extensionsfreed by the earlier shrink.  The stream can then be in range while itsextension remains NULL.  The send-buffer wait has the same issue.\nFactor the range and extension checks into a helper and repeat both aftereach send-path wait that drops the socket lock.  Once the lock isreacquired, the validation remains stable through data creation andqueueing.\nIf validation fails after the connect wait, the auto-created association isalready established.  Return ESRCH so the existing caller path keeps itunder state-machine ownership instead of freeing it directly, which wouldleave protocol, counter and socket state inconsistent.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99165https://git.kernel.org/stable/c/77a63d1b813b08c4e5a948f5e04fbaca6176aa8fhttps://git.kernel.org/stable/c/fd56ac95ec31a05b66e8938debfa847f49c0e993https://git.kernel.org/stable/c/b7ad72414c673ce1fa1f463e807cd4f34f8be9bf#kernel #Linux#CVE_2026_99165#bot", "url": "https://infosec.exchange/users/cve/statuses/117518293924913559"}, {"timestamp": "2026-10-28T12:31:06Z", "date_only": false, "value": "2026-10-28T12:31:06Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-H9P5-Q3G4-GM7M", "record": "GHSA-H9P5-Q3G4-GM7M", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T01:06:47Z", "date_only": false, "value": "2026-10-29T01:06:47.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99165", "record": "MSRC_CVE-2026-99165", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-29T01:06:47Z", "date_only": false, "value": "2026-10-29T01:06:47.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99165", "record": "MSRC_CVE-2026-99165", "field": "vulnerabilities.0.remediations.0.date", "linked_record": true}, {"timestamp": "2026-10-29T01:06:47Z", "date_only": false, "value": "2026-10-29T01:06:47.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99165", "record": "MSRC_CVE-2026-99165", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:08:47.563Z", "date_only": false, "value": "2026-10-30T06:08:47.563760Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99165", "record": "BELL-CVE-2026-99165", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T12:42:30.300Z", "date_only": false, "value": "2026-10-30T12:42:30.300Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99165", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T12:42:30.300Z", "date_only": false, "value": "2026-10-30T12:42:30.300Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99165", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T13:21:50.193Z", "date_only": false, "value": "2026-10-30T13:21:50.193", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99165", "record": "FKIE_CVE-2026-99165", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-30T15:34:23Z", "date_only": false, "value": "2026-10-30T15:34:23Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-H9P5-Q3G4-GM7M", "record": "GHSA-H9P5-Q3G4-GM7M", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T19:04:00Z", "date_only": false, "value": "2026-10-30T19:04:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99165", "record": "UBUNTU-CVE-2026-99165", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-01T14:51:17Z", "date_only": false, "value": "2026-11-01T14:51:17.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99165", "record": "MSRC_CVE-2026-99165", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-01T14:51:17Z", "date_only": false, "value": "2026-11-01T14:51:17.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99165", "record": "MSRC_CVE-2026-99165", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-02T08:02:48.152Z", "date_only": false, "value": "2026-11-02T08:02:48.152Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99165", "record": "MSRC_CVE-2026-99165", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-03T20:04:14.241Z", "date_only": false, "value": "2026-11-03T20:04:14.241571Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99165", "record": "BELL-CVE-2026-99165", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-05T02:23:23.578Z", "anchors": {"origin": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99165", "record": "UBUNTU-CVE-2026-99165", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99165", "record": "UBUNTU-CVE-2026-99165", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 699803.57892, "hours": 194.38988303333332, "days": 8.099578459722222, "min_seconds": 613403.57892, "max_seconds": 699803.57892, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99165", "record": "UBUNTU-CVE-2026-99165", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-05T02:23:23.578Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}