{"metadata": {"vulnerability": "CVE-2026-99166", "count": 20, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 12}}, "data": [{"timestamp": "2026-09-25T10:25:14.398Z", "date_only": false, "value": "2026-09-25T10:25:14.398Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99166", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99166", "record": "UBUNTU-CVE-2026-99166", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T10:35:18.050Z", "date_only": false, "value": "2026-10-28T10:35:18.050Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99166", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T11:17:37Z", "date_only": false, "value": "2026-10-28T11:17:37Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-6552-7G22-4QF3", "record": "GHSA-6552-7G22-4QF3", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-28T11:17:37.043Z", "date_only": false, "value": "2026-10-28T11:17:37.043", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99166", "record": "FKIE_CVE-2026-99166", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T11:28:20.497Z", "date_only": false, "value": "2026-10-28T11:28:20.497865Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117518296567827106", "record": "CVE-2026-99166", "field": "creation_timestamp", "uuid": "52f1a763-b51b-4783-aef4-defe4abf4636", "content": "CVE-2026-99166 net: rds: fix uninitialized trans dereference in CM event handler In the Linux kernel, the following vulnerability has been resolved:\nnet: rds: fix uninitialized trans dereference in CM event handler\nrds_rdma_cm_event_handler_cmn() assigns trans only when the RDMAdevice is an InfiniBand CA (RDMA_NODE_IB_CA).  On any other devicetype, e.g. an iWARP RNIC such as siw, trans stays uninitialized, butthe event switch dereferences it: unconditionally in theRDMA_CM_EVENT_CONNECT_REQUEST case via trans->cm_handle_connect(),and (with a connection context) in the ROUTE_RESOLVED andESTABLISHED cases.\nAn RDS listener on an iWARP device therefore crashes the kernel assoon as a connect request arrives: with CONFIG_INIT_STACK_ALL_ZEROthe wild load becomes a NULL dereference at offset 0xa0(&trans->cm_handle_connect) in the iw_cm_wq workqueue.\nGCC masks the bug in default builds by folding the uninitializedload into &rds_ib_transport; Clang-built kernels take the realuninitialized path and oops.\nThe active side can land on a non-IB device too: the id thatrds_ib_conn_path_connect() creates is not restricted to a node type,so rdma_resolve_addr() binds it to whichever device serves the localaddress, and an iWARP RNIC on the same netdev qualifies.  The crashthere is different: resolving a route on an iWARP id never fills incm_id->route.path_rec, and the ROUTE_RESOLVED case writespath_rec[0].sl before it calls into the transport.\nThe iWARP transport was dropped long ago and IB is the onlytransport left, so make that explicit: initialize trans to&rds_ib_transport at declaration, drop the conditional assignment,reject a connect request that arrives on a non-IB device, and drop aconnection whose address resolved to one instead of resolving aroute on it.  The rejection is limited to RDMA_CM_EVENT_CONNECT_REQUESTon purpose: a non-zero return from the handler makes rdma_cm destroythe id the event was delivered on, which is right for the request'sfreshly created id but would free a connection id that RDS still ownsfor any other event.  On the active side the id stays ic->i_cm_id andthe connection's shutdown destroys it, so that case returns 0.\n[achender: reject only on RDMA_CM_EVENT_CONNECT_REQUEST instead of bailing out for every event on a non-IB device, so that rdma_cm does not destroy connection ids RDS still tracks; drop a connection whose address resolved to a non-IB device before a route is resolved on it; changelog adjusted]\nhttps://www.cve.org/CVERecord?id=CVE-2026-99166https://git.kernel.org/stable/c/5f23e4e3a31dacfd82a8f56be253adc0910ee84fhttps://git.kernel.org/stable/c/ca14c289ed9ffed6cc64290d039e923e5720a8bfhttps://git.kernel.org/stable/c/492ba6ac1b1ffb8a06ff52db0825c1af2cdb28c8#kernel #Linux#CVE_2026_99166#bot", "url": "https://infosec.exchange/users/cve/statuses/117518296567827106"}, {"timestamp": "2026-10-28T12:31:06Z", "date_only": false, "value": "2026-10-28T12:31:06Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6552-7G22-4QF3", "record": "GHSA-6552-7G22-4QF3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T01:06:52Z", "date_only": false, "value": "2026-10-29T01:06:52.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99166", "record": "MSRC_CVE-2026-99166", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-29T01:06:52Z", "date_only": false, "value": "2026-10-29T01:06:52.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99166", "record": "MSRC_CVE-2026-99166", "field": "vulnerabilities.0.remediations.0.date", "linked_record": true}, {"timestamp": "2026-10-29T01:06:52Z", "date_only": false, "value": "2026-10-29T01:06:52.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99166", "record": "MSRC_CVE-2026-99166", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:08:47.622Z", "date_only": false, "value": "2026-10-30T06:08:47.622529Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99166", "record": "BELL-CVE-2026-99166", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T12:42:32.571Z", "date_only": false, "value": "2026-10-30T12:42:32.571Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99166", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T12:42:32.571Z", "date_only": false, "value": "2026-10-30T12:42:32.571Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99166", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T13:21:50.340Z", "date_only": false, "value": "2026-10-30T13:21:50.340", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99166", "record": "FKIE_CVE-2026-99166", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-30T15:34:24Z", "date_only": false, "value": "2026-10-30T15:34:24Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6552-7G22-4QF3", "record": "GHSA-6552-7G22-4QF3", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T19:04:00Z", "date_only": false, "value": "2026-10-30T19:04:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99166", "record": "UBUNTU-CVE-2026-99166", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-01T14:51:21Z", "date_only": false, "value": "2026-11-01T14:51:21.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99166", "record": "MSRC_CVE-2026-99166", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-01T14:51:21Z", "date_only": false, "value": "2026-11-01T14:51:21.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99166", "record": "MSRC_CVE-2026-99166", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-02T08:02:48.152Z", "date_only": false, "value": "2026-11-02T08:02:48.152Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99166", "record": "MSRC_CVE-2026-99166", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-03T20:04:14.313Z", "date_only": false, "value": "2026-11-03T20:04:14.313346Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99166", "record": "BELL-CVE-2026-99166", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-04T22:00:46.543Z", "anchors": {"origin": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99166", "record": "UBUNTU-CVE-2026-99166", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99166", "record": "UBUNTU-CVE-2026-99166", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 684046.543363, "hours": 190.01292871194445, "days": 7.917205362997685, "min_seconds": 597646.543363, "max_seconds": 684046.543363, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99166", "record": "UBUNTU-CVE-2026-99166", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-04T22:00:46.543Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}