{"metadata": {"vulnerability": "CVE-2026-99180", "count": 20, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 12}}, "data": [{"timestamp": "2026-09-25T10:25:14.399Z", "date_only": false, "value": "2026-09-25T10:25:14.399Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99180", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99180", "record": "UBUNTU-CVE-2026-99180", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T10:35:33.578Z", "date_only": false, "value": "2026-10-28T10:35:33.578Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99180", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T11:17:38Z", "date_only": false, "value": "2026-10-28T11:17:38Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VCMX-2WRH-M3MJ", "record": "GHSA-VCMX-2WRH-M3MJ", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-28T11:17:38.753Z", "date_only": false, "value": "2026-10-28T11:17:38.753", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99180", "record": "FKIE_CVE-2026-99180", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T11:37:44.638Z", "date_only": false, "value": "2026-10-28T11:37:44.638258Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117518333649943785", "record": "CVE-2026-99180", "field": "creation_timestamp", "uuid": "a3e21124-3f6b-4d20-a4e4-b03fc1d1e4fb", "content": "CVE-2026-99180 unicode: free the map after a grace period In the Linux kernel, the following vulnerability has been resolved:\nunicode: free the map after a grace period\ngeneric_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding anddereference the unicode map while a pathwalk in rcu mode holds nothingbut rcu_read_lock(). The filesystems that use them, ext4, f2fs andtmpfs, drop the map with utf8_unload() from ->put_super(), which runswhen the last reference to the mount goes away. A lookup that is stillinside such a filesystem at that point reads a freed map.\nWith a pathwalk held up in utf8_casefold_hash() while the last referenceto a casefolded tmpfs goes away:\n  BUG: KASAN: slab-use-after-free in utf8nlookup+0x74c/0x950  Read of size 8 at addr ff110001030fe658 by task walker/98  Call Trace:   <TASK>   utf8nlookup+0x74c/0x950   utf8byte+0x160/0x1560   utf8_casefold_hash+0x167/0x230   generic_ci_d_hash+0xdd/0x1c0   link_path_walk+0x11ad/0x1d30   path_lookupat+0x63/0xb00   filename_lookup+0x1f1/0x5b0   vfs_statx+0xd7/0x3b0  [...]  Allocated by task 94:   __kmalloc_cache_noprof+0x249/0x560   utf8_load+0x4e/0x570   shmem_parse_opt_casefold.isra.0+0x92/0x270  [...]  Freed by task 97:   kfree+0x1db/0x5b0   shmem_put_super+0x72/0x170   generic_shutdown_super+0x14c/0x530   kill_anon_super+0x3a/0x60   deactivate_locked_super+0x9c/0xf0   cleanup_mnt+0x9f/0x130\nSo far that has been hard to hit. umount(2) waits for a grace periodin namespace_unlock() before it drops the mount, so only a mount whoselast reference goes away elsewhere, like the close of a file or a chdirout of a lazily unmounted directory, can race a walker. So it isreachable.\nDelay the free until a grace period has passed. The map and the datatable it holds a reference to then outlive any pathwalk that found thesuperblock before the mount went away. The reference on the data tablemodule is dropped from the rcu callback as well. utf8-core is built inwhenever CONFIG_UNICODE is set, so there is no module exit that wouldhave to wait for the callbacks.\nOverlayfs points the s_encoding of an overlay at the map of its firstlayer without taking a reference of its own. That stays correct. Thelayer is held by the overlay, so its map is dropped only after theoverlay is gone.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99180https://git.kernel.org/stable/c/2b54d3c971a1e5df3c9b0bcc10311ae6c29e79d8https://git.kernel.org/stable/c/6560c3d9a6925e3747d9ad8463e16010c31ba715https://git.kernel.org/stable/c/a96c5299bd7305eb984377681eb3222a57376405#kernel #Linux#CVE_2026_99180#bot", "url": "https://infosec.exchange/users/cve/statuses/117518333649943785"}, {"timestamp": "2026-10-28T12:31:07Z", "date_only": false, "value": "2026-10-28T12:31:07Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VCMX-2WRH-M3MJ", "record": "GHSA-VCMX-2WRH-M3MJ", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T01:07:45Z", "date_only": false, "value": "2026-10-29T01:07:45.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99180", "record": "MSRC_CVE-2026-99180", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-29T01:07:45Z", "date_only": false, "value": "2026-10-29T01:07:45.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99180", "record": "MSRC_CVE-2026-99180", "field": "vulnerabilities.0.remediations.0.date", "linked_record": true}, {"timestamp": "2026-10-29T01:07:45Z", "date_only": false, "value": "2026-10-29T01:07:45.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99180", "record": "MSRC_CVE-2026-99180", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:08:47.740Z", "date_only": false, "value": "2026-10-30T06:08:47.740286Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99180", "record": "BELL-CVE-2026-99180", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-31T12:44:50.381Z", "date_only": false, "value": "2026-10-31T12:44:50.381Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99180", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-31T12:44:50.381Z", "date_only": false, "value": "2026-10-31T12:44:50.381Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99180", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-31T13:17:58.987Z", "date_only": false, "value": "2026-10-31T13:17:58.987", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99180", "record": "FKIE_CVE-2026-99180", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-31T15:30:23Z", "date_only": false, "value": "2026-10-31T15:30:23Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VCMX-2WRH-M3MJ", "record": "GHSA-VCMX-2WRH-M3MJ", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-01T14:52:09Z", "date_only": false, "value": "2026-11-01T14:52:09.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99180", "record": "MSRC_CVE-2026-99180", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-01T14:52:09Z", "date_only": false, "value": "2026-11-01T14:52:09.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99180", "record": "MSRC_CVE-2026-99180", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-02T08:02:48.152Z", "date_only": false, "value": "2026-11-02T08:02:48.152Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99180", "record": "MSRC_CVE-2026-99180", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-03T18:16:18Z", "date_only": false, "value": "2026-11-03T18:16:18Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99180", "record": "UBUNTU-CVE-2026-99180", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T20:04:14.871Z", "date_only": false, "value": "2026-11-03T20:04:14.871557Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99180", "record": "BELL-CVE-2026-99180", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-04T23:55:56.454Z", "anchors": {"origin": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99180", "record": "UBUNTU-CVE-2026-99180", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99180", "record": "UBUNTU-CVE-2026-99180", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 690956.454877, "hours": 191.93234857694443, "days": 7.997181190706018, "min_seconds": 604556.454877, "max_seconds": 690956.454877, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99180", "record": "UBUNTU-CVE-2026-99180", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-04T23:55:56.454Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}