{"metadata": {"vulnerability": "CVE-2026-99222", "count": 33, "kinds": {"milestone": 9, "sighting": 1, "kev": 0, "other": 23}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-25T10:25:14.402Z", "date_only": false, "value": "2026-09-25T10:25:14.402Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99222", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-02T16:06:32.844Z", "date_only": false, "value": "2026-11-02T16:06:32.844Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99222", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-02T16:17:00Z", "date_only": false, "value": "2026-11-02T16:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99222", "record": "UBUNTU-CVE-2026-99222", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T16:17:46Z", "date_only": false, "value": "2026-11-02T16:17:46Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J4RG-4W46-639C", "record": "GHSA-J4RG-4W46-639C", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-02T16:17:46.460Z", "date_only": false, "value": "2026-11-02T16:17:46.460", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99222", "record": "FKIE_CVE-2026-99222", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T16:27:05.084Z", "date_only": false, "value": "2026-11-02T16:27:05.084712Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117547753388728492", "record": "CVE-2026-99222", "field": "creation_timestamp", "uuid": "e493c6ca-d64a-4d06-b72c-3b3eb5a9837f", "content": "CVE-2026-99222 keys: Protect the read method check against type removal In the Linux kernel, the following vulnerability has been resolved:\nkeys: Protect the read method check against type removal\nkeyctl_read_key() checks key->type->read without holding key->sem.A reference keeps the key alive, but does not pin the module containingits type. A surviving RxRPC key can therefore be read while AF_RXRPCis being unloaded:\n  KEYCTL_READ task                    Module unload and key GC  ----------------                   ------------------------  lookup_user_key()  permission / possession checks  load key->type                                     af_rxrpc_exit()                                       unregister_key_type()                                         GC: down_write(key->sem)                                         GC: retype to key_type_dead                                         GC: up_write(key->sem)                                       unregister_key_type() returns                                     free_module()  read saved type's read member\nThe final access can read freed module storage. The read invocation in__keyctl_read_key() is already protected by key->sem, but the earliermethod check is outside that critical section.\nMove the method check into __keyctl_read_key(), after key_validate() andunder its existing read hold on key->sem. The check and invocation thenuse the same protected type for length queries and every read retry.The GC cannot retype the key until the semaphore is released, and typeunregistration waits for that GC pass before the module can be freed.\nReturn -EOPNOTSUPP when validation succeeds and the type has no readmethod. A temporary buffer may now be allocated before this result;allocation and copying to userspace remain outside the semaphore.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99222https://git.kernel.org/stable/c/e5f830ae6611cddbfc504c43f14155f60b63206ahttps://git.kernel.org/stable/c/ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8dhttps://git.kernel.org/stable/c/1486caee47b4909f52835a957c3293e970113e44https://git.kernel.org/stable/c/ff44f1b303aa76a818d898e85c56ed4852c031e2https://git.kernel.org/stable/c/6a36e2a1a017c51f8a8ad2a094566bad97c46a9bhttps://git.kernel.org/stable/c/3edc064069d07e7d37359fcb4d03d3bab15ee3abhttps://git.kernel.org/stable/c/cf1af7df80e38bf58bd74c2cccce32fcbd1a596ahttps://git.kernel.org/stable/c/e2a2deda08d91644f5e30c17d267b1cdc5f124b2#kernel #Linux#CVE_2026_99222#bot", "url": "https://infosec.exchange/users/cve/statuses/117547753388728492"}, {"timestamp": "2026-11-02T18:32:26Z", "date_only": false, "value": "2026-11-02T18:32:26Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J4RG-4W46-639C", "record": "GHSA-J4RG-4W46-639C", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T23:00:00Z", "date_only": false, "value": "2026-11-02T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4302", "record": "WID-SEC-W-2026-4302", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-02T23:00:00Z", "date_only": false, "value": "2026-11-02T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4302", "record": "WID-SEC-W-2026-4302", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T23:00:00Z", "date_only": false, "value": "2026-11-02T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4302", "record": "WID-SEC-W-2026-4302", "field": "vulnerabilities.5.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-03T19:12:56.503Z", "date_only": false, "value": "2026-11-03T19:12:56.503Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99222", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-03T19:12:56.503Z", "date_only": false, "value": "2026-11-03T19:12:56.503Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99222", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-03T20:18:27.500Z", "date_only": false, "value": "2026-11-03T20:18:27.500", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99222", "record": "FKIE_CVE-2026-99222", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-03T21:31:59Z", "date_only": false, "value": "2026-11-03T21:31:59Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J4RG-4W46-639C", "record": "GHSA-J4RG-4W46-639C", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T23:00:00Z", "date_only": false, "value": "2026-11-03T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4302", "record": "WID-SEC-W-2026-4302", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-04T01:01:52Z", "date_only": false, "value": "2026-11-04T01:01:52.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99222", "record": "MSRC_CVE-2026-99222", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-04T01:01:52Z", "date_only": false, "value": "2026-11-04T01:01:52.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99222", "record": "MSRC_CVE-2026-99222", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-04T01:01:52Z", "date_only": false, "value": "2026-11-04T01:01:52.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99222", "record": "MSRC_CVE-2026-99222", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T06:06:20.540Z", "date_only": false, "value": "2026-11-05T06:06:20.540654Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99222", "record": "BELL-CVE-2026-99222", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T14:52:43Z", "date_only": false, "value": "2026-11-05T14:52:43.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99222", "record": "MSRC_CVE-2026-99222", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-05T14:52:43Z", "date_only": false, "value": "2026-11-05T14:52:43.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99222", "record": "MSRC_CVE-2026-99222", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-06T08:00:55.457Z", "date_only": false, "value": "2026-11-06T08:00:55.457Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99222", "record": "MSRC_CVE-2026-99222", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12497-1", "record": "OPENSUSE-SU-2026:12497-1", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12497-1", "record": "OPENSUSE-SU-2026:12497-1", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00Z", "kind": "other", "label": "Impact", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12497-1", "record": "OPENSUSE-SU-2026:12497-1", "field": "vulnerabilities.0.threats.0.date", "linked_record": true}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12497-1", "record": "OPENSUSE-SU-2026:12497-1", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T14:58:22Z", "date_only": false, "value": "2026-11-10T14:58:22Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12497-1", "record": "OPENSUSE-SU-2026:12497-1", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-10T14:58:22Z", "date_only": false, "value": "2026-11-10T14:58:22Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12497-1", "record": "OPENSUSE-SU-2026:12497-1", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-10T20:02:28.152Z", "date_only": false, "value": "2026-11-10T20:02:28.15222Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99222", "record": "BELL-CVE-2026-99222", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-10T23:00:00Z", "date_only": false, "value": "2026-11-10T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4302", "record": "WID-SEC-W-2026-4302", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-10T23:00:00Z", "date_only": false, "value": "2026-11-10T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4302", "record": "WID-SEC-W-2026-4302", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-11T11:32:32.124Z", "date_only": false, "value": "2026-11-11T11:32:32.124+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4302", "record": "WID-SEC-W-2026-4302", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-12T14:11:06Z", "date_only": false, "value": "2026-11-12T14:11:06Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99222", "record": "UBUNTU-CVE-2026-99222", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-12T21:52:09.154Z", "anchors": {"origin": {"timestamp": "2026-11-02T16:06:32.844Z", "date_only": false, "value": "2026-11-02T16:06:32.844Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99222", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-02T16:06:32.844Z", "date_only": false, "value": "2026-11-02T16:06:32.844Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99222", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": {"timestamp": "2026-11-04T01:01:52Z", "date_only": false, "value": "2026-11-04T01:01:52.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99222", "record": "MSRC_CVE-2026-99222", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": false, "missing": ["start"]}, "disclosure_to_patch": {"available": true, "seconds": 118519.156, "hours": 32.92198777777778, "days": 1.3717494907407408, "min_seconds": 118519.156, "max_seconds": 118519.156, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-02T16:06:32.844Z", "date_only": false, "value": "2026-11-02T16:06:32.844Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99222", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-04T01:01:52Z", "date_only": false, "value": "2026-11-04T01:01:52.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99222", "record": "MSRC_CVE-2026-99222", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "time_unpatched": {"available": true, "seconds": 118519.156, "hours": 32.92198777777778, "days": 1.3717494907407408, "min_seconds": 118519.156, "max_seconds": 118519.156, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-02T16:06:32.844Z", "date_only": false, "value": "2026-11-02T16:06:32.844Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99222", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-04T01:01:52Z", "date_only": false, "value": "2026-11-04T01:01:52.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99222", "record": "MSRC_CVE-2026-99222", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}