{"metadata": {"vulnerability": "CVE-2026-99178", "count": 20, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 12}}, "data": [{"timestamp": "2026-09-25T10:25:14.399Z", "date_only": false, "value": "2026-09-25T10:25:14.399Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99178", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99178", "record": "UBUNTU-CVE-2026-99178", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T10:35:31.961Z", "date_only": false, "value": "2026-10-28T10:35:31.961Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99178", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T11:17:38Z", "date_only": false, "value": "2026-10-28T11:17:38Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9W29-5GPQ-XMV3", "record": "GHSA-9W29-5GPQ-XMV3", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-28T11:17:38.503Z", "date_only": false, "value": "2026-10-28T11:17:38.503", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99178", "record": "FKIE_CVE-2026-99178", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T11:36:23.774Z", "date_only": false, "value": "2026-10-28T11:36:23.774766Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117518328339369066", "record": "CVE-2026-99178", "field": "creation_timestamp", "uuid": "5edefcc5-e210-403c-ab92-b82b9ff29aa8", "content": "CVE-2026-99178 x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context In the Linux kernel, the following vulnerability has been resolved:\nx86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context\nAn async #PF \"page not present\" event arrives through the #PF vector,and its reason sits in the per-CPU apf_reason.flags until__kvm_handle_async_pf() reads and clears it. If an NMI arrives afterthe event is injected and before the #PF handler reads the flags, andthe NMI handler itself takes a #PF, that fault reads and clears theflags belonging to the #PF it interrupted. It then finds interruptsdisabled in the NMI context it interrupted, and panics:\n  Kernel panic - not syncing: Host injected async #PF in interruptdisabled region  Call Trace:   <NMI>   panic+0x52/0x60   __kvm_handle_async_pf+0xb0/0xb0   exc_page_fault+0x71/0xb0   asm_exc_page_fault+0x27/0x30  RIP: 0010:__get_user_nocheck_8+0x6/0x20   perf_callchain_user+0x147/0x1a0   get_perf_callchain+0x12d/0x1c0   ...   perf_event_nmi_handler+0x26/0x50   exc_nmi+0xe8/0x110  RIP: 0010:asm_exc_page_fault+0x0/0x30   </NMI>\nThe last RIP line shows the NMI landing on the first instruction ofthe #PF entry. perf with user call chains takes such a fault: thesampling NMI walks the user stack with __get_user(), which faults whena saved frame pointer is not a valid user address or the walk runs offthe top of the stack. The same window exists when KVM, running as anL1 hypervisor with DELIVERY_AS_PF_VMEXIT, reads the flags itself aftera #PF VM-exit.\nThe NMI entry code saves and restores CR2 for this nesting, but not theasync #PF reason. Andy Lutomirski described the race, with perf as theexample, when async #PF delivery was reworked in 2020 [1]. Saving andclearing the flags across the NMI, next to CR2, was discussed there butnot merged.\nSince that rework, Linux has stopped setting KVM_ASYNC_PF_SEND_ALWAYS,so the host delivers \"page not present\" only for user mode faults anda kernel-mode fault in NMI context (including kernel-mode #MC and #DB)cannot be an async page fault.  In that case, return without touchingthe flags so that the interrupted handler finds them intact.\nTested on v7.3-rc5 in a 4-vCPU, 2 GiB guest restored from a snapshotwhose memory is served on demand through userfaultfd, so that readingit back takes async #PFs, while every thread samples hardware cycleswith user call chains and points its frame pointer at an unmapped page.Without this patch the guest panicked as above in 3 of 3 runs. With it,the guest survived 3 of 3 runs of 60 seconds, and the host counted148,441 to 153,334 kvm_async_pf_not_present events in the first 20seconds of each. On 6.18.50 the results were the same: the guestpanicked without the patch and survived with it.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99178https://git.kernel.org/stable/c/b77e9622bbade9812e2090c66d25c372f515e921https://git.kernel.org/stable/c/f45ee1ff6358a22d7e22a4c53cb3148ea97b10d9https://git.kernel.org/stable/c/81d99abe2bd81379abfb595e403bbbee6fbfc624#kernel #Linux#CVE_2026_99178#bot", "url": "https://infosec.exchange/users/cve/statuses/117518328339369066"}, {"timestamp": "2026-10-28T12:31:07Z", "date_only": false, "value": "2026-10-28T12:31:07Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9W29-5GPQ-XMV3", "record": "GHSA-9W29-5GPQ-XMV3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T01:07:37Z", "date_only": false, "value": "2026-10-29T01:07:37.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99178", "record": "MSRC_CVE-2026-99178", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-29T01:07:37Z", "date_only": false, "value": "2026-10-29T01:07:37.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99178", "record": "MSRC_CVE-2026-99178", "field": "vulnerabilities.0.remediations.0.date", "linked_record": true}, {"timestamp": "2026-10-29T01:07:37Z", "date_only": false, "value": "2026-10-29T01:07:37.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99178", "record": "MSRC_CVE-2026-99178", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:06:44.364Z", "date_only": false, "value": "2026-10-30T06:06:44.364097Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99178", "record": "BELL-CVE-2026-99178", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T15:34:23Z", "date_only": false, "value": "2026-10-30T15:34:23Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9W29-5GPQ-XMV3", "record": "GHSA-9W29-5GPQ-XMV3", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T19:04:03Z", "date_only": false, "value": "2026-10-30T19:04:03Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99178", "record": "UBUNTU-CVE-2026-99178", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-01T12:42:11.076Z", "date_only": false, "value": "2026-11-01T12:42:11.076Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99178", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-01T12:42:11.076Z", "date_only": false, "value": "2026-11-01T12:42:11.076Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99178", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-01T13:18:02.150Z", "date_only": false, "value": "2026-11-01T13:18:02.150", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99178", "record": "FKIE_CVE-2026-99178", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-01T14:51:58Z", "date_only": false, "value": "2026-11-01T14:51:58.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99178", "record": "MSRC_CVE-2026-99178", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-01T14:51:58Z", "date_only": false, "value": "2026-11-01T14:51:58.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99178", "record": "MSRC_CVE-2026-99178", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-02T08:02:48.152Z", "date_only": false, "value": "2026-11-02T08:02:48.152Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99178", "record": "MSRC_CVE-2026-99178", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-03T06:24:04.987Z", "date_only": false, "value": "2026-11-03T06:24:04.987820Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99178", "record": "BELL-CVE-2026-99178", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-05T02:00:26.750Z", "anchors": {"origin": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99178", "record": "UBUNTU-CVE-2026-99178", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99178", "record": "UBUNTU-CVE-2026-99178", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 698426.750458, "hours": 194.00743068277777, "days": 8.083642945115741, "min_seconds": 612026.750458, "max_seconds": 698426.750458, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99178", "record": "UBUNTU-CVE-2026-99178", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-05T02:00:26.750Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}