{"metadata": {"vulnerability": "CVE-2026-99204", "count": 20, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 12}}, "data": [{"timestamp": "2026-09-25T10:25:14.400Z", "date_only": false, "value": "2026-09-25T10:25:14.400Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99204", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99204", "record": "UBUNTU-CVE-2026-99204", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T10:35:58.336Z", "date_only": false, "value": "2026-10-28T10:35:58.336Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99204", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T11:17:41Z", "date_only": false, "value": "2026-10-28T11:17:41Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-H9Q4-GJ29-45HP", "record": "GHSA-H9Q4-GJ29-45HP", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-28T11:17:41.633Z", "date_only": false, "value": "2026-10-28T11:17:41.633", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99204", "record": "FKIE_CVE-2026-99204", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T11:53:53.652Z", "date_only": false, "value": "2026-10-28T11:53:53.652531Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117518397156055264", "record": "CVE-2026-99204", "field": "creation_timestamp", "uuid": "0eccc6ae-9036-42ac-9c16-3c755ee8414e", "content": "CVE-2026-99204 ocfs2/dlm: Protect the recovery list during debugfs reads In the Linux kernel, the following vulnerability has been resolved:\nocfs2/dlm: Protect the recovery list during debugfs reads\nRecovery participant records must remain alive while debug_state_print()walks reco.node_data and formats their fields. The formatter holdsdlm->spinlock, but the recovery participant list is protected bydlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detachesthe list under dlm_reco_state_lock and frees the detached records afterreleasing it. A concurrent debugfs open can therefore read freed memory.\nProtect the participant traversal and field reads in debug_state_print()with dlm_reco_state_lock, matching the existing list writers. This alsoserializes the traversal against list_add_tail() during recovery-areainitialization. Make the existing lock available to the debug codethrough dlmcommon.h; the lock remains internal to the OCFS2 DLM module.\nRelease dlm->spinlock after formatting the other domain state and beforeacquiring dlm_reco_state_lock, so the debug reader does not nest the twolocks. Leave recovery list insertion, detachment and freeing unchanged.\nKASAN report as below:\n    BUG: KASAN: slab-use-after-free in debug_state_open+0x1169/0x12d0    Read of size 4 at addr ffff88810662ef80 by task dlm-state-stres/896\n    CPU: 1 UID: 0 PID: 896 Comm: dlm-state-stres Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy)    Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014    Call Trace:     <TASK>     dump_stack_lvl+0x93/0xd0     print_report+0xce/0x630     ? debug_state_open+0x1169/0x12d0     ? srso_alias_return_thunk+0x5/0xfbef5     ? __virt_addr_valid+0x20e/0x420     ? debug_state_open+0x1169/0x12d0     kasan_report+0xe0/0x110     ? debug_state_open+0x1169/0x12d0     debug_state_open+0x1169/0x12d0     ? __pfx_debug_state_open+0x10/0x10     full_proxy_open_regular+0x193/0x310     do_dentry_open+0x595/0x12d0     ? __pfx_full_proxy_open_regular+0x10/0x10     vfs_open_consume+0xd1/0x400     ? srso_alias_return_thunk+0x5/0xfbef5     path_openat+0x18d0/0x2020     ? __pfx_path_openat+0x10/0x10     do_file_open+0x21e/0x470     ? __pfx_do_file_open+0x10/0x10     ? _raw_spin_unlock+0x23/0x40     ? srso_alias_return_thunk+0x5/0xfbef5     ? alloc_fd+0x3a6/0x6b0     do_sys_openat2+0xf4/0x1b0     ? __pfx_do_sys_openat2+0x10/0x10     ? srso_alias_return_thunk+0x5/0xfbef5     ? __fput+0x5b5/0xa60     __x64_sys_openat+0x136/0x1e0     ? __pfx___x64_sys_openat+0x10/0x10     do_syscall_64+0x114/0x620     entry_SYSCALL_64_after_hwframe+0x77/0x7f    [Register dump omitted.]     </TASK>\n    Allocated by task 880:     kasan_save_stack+0x33/0x60     kasan_save_track+0x14/0x30     __kasan_kmalloc+0xaa/0xb0     __kmalloc_cache_noprof+0x28d/0x610     dlm_remaster_locks+0x147/0x1d90     dlm_do_recovery+0xde1/0x1580     dlm_recovery_thread+0x109/0x300     kthread+0x351/0x460     ret_from_fork+0x659/0x940     ret_from_fork_asm+0x1a/0x30\n    Freed by task 880:     kasan_save_stack+0x33/0x60     kasan_save_track+0x14/0x30     kasan_save_free_info+0x3b/0x60     __kasan_slab_free+0x5f/0x80     kfree+0x308/0x580     dlm_destroy_recovery_area+0x285/0x460     dlm_remaster_locks+0x17c4/0x1d90     dlm_do_recovery+0xde1/0x1580     dlm_recovery_thread+0x109/0x300     kthread+0x351/0x460     ret_from_fork+0x659/0x940     ret_from_fork_asm+0x1a/0x30\n    The buggy address belongs to the object at ffff88810662ef80     which belongs to the cache kmalloc-32 of size 32    The buggy address is located 0 bytes inside of     freed 32-byte region [ffff88810662ef80, ffff88810662efa0)\n    [Page and memory-state dumps omitted.]\nhttps://www.cve.org/CVERecord?id=CVE-2026-99204https://git.kernel.org/stable/c/04d4571c00db61a9664f387752fa05cb3c08a537https://git.kernel.org/stable/c/2bc426a32bfb78868c7f76d9547132837b6b5284https://git.kernel.org/stable/c/4c435828932bf46f29860e4a0375bcae101b778a#kernel #Linux#CVE_2026_99204#bot", "url": "https://infosec.exchange/users/cve/statuses/117518397156055264"}, {"timestamp": "2026-10-28T12:31:08Z", "date_only": false, "value": "2026-10-28T12:31:08Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-H9Q4-GJ29-45HP", "record": "GHSA-H9Q4-GJ29-45HP", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T01:08:33Z", "date_only": false, "value": "2026-10-29T01:08:33.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99204", "record": "MSRC_CVE-2026-99204", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-29T01:08:33Z", "date_only": false, "value": "2026-10-29T01:08:33.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99204", "record": "MSRC_CVE-2026-99204", "field": "vulnerabilities.0.remediations.0.date", "linked_record": true}, {"timestamp": "2026-10-29T01:08:33Z", "date_only": false, "value": "2026-10-29T01:08:33.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99204", "record": "MSRC_CVE-2026-99204", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:06:44.992Z", "date_only": false, "value": "2026-10-30T06:06:44.992224Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99204", "record": "BELL-CVE-2026-99204", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T12:42:54.359Z", "date_only": false, "value": "2026-10-30T12:42:54.359Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99204", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T12:42:54.359Z", "date_only": false, "value": "2026-10-30T12:42:54.359Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99204", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T13:21:52.933Z", "date_only": false, "value": "2026-10-30T13:21:52.933", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99204", "record": "FKIE_CVE-2026-99204", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-30T15:34:24Z", "date_only": false, "value": "2026-10-30T15:34:24Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-H9Q4-GJ29-45HP", "record": "GHSA-H9Q4-GJ29-45HP", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T19:04:07Z", "date_only": false, "value": "2026-10-30T19:04:07Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99204", "record": "UBUNTU-CVE-2026-99204", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-01T14:53:39Z", "date_only": false, "value": "2026-11-01T14:53:39.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99204", "record": "MSRC_CVE-2026-99204", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-01T14:53:39Z", "date_only": false, "value": "2026-11-01T14:53:39.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99204", "record": "MSRC_CVE-2026-99204", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-02T08:02:48.157Z", "date_only": false, "value": "2026-11-02T08:02:48.157Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99204", "record": "MSRC_CVE-2026-99204", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-03T20:04:15.268Z", "date_only": false, "value": "2026-11-03T20:04:15.268923Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99204", "record": "BELL-CVE-2026-99204", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-04T23:56:05.297Z", "anchors": {"origin": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99204", "record": "UBUNTU-CVE-2026-99204", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99204", "record": "UBUNTU-CVE-2026-99204", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 690965.29764, "hours": 191.9348049, "days": 7.9972835375, "min_seconds": 604565.29764, "max_seconds": 690965.29764, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T00:00:00Z", "date_only": false, "value": "2026-10-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99204", "record": "UBUNTU-CVE-2026-99204", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-04T23:56:05.297Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}