{"metadata": {"vulnerability": "CVE-2026-99223", "count": 12, "kinds": {"milestone": 5, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-09-25T10:25:14.402Z", "date_only": false, "value": "2026-09-25T10:25:14.402Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99223", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-02T16:06:33.408Z", "date_only": false, "value": "2026-11-02T16:06:33.408Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99223", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-02T16:17:46Z", "date_only": false, "value": "2026-11-02T16:17:46Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-4488-HMFW-WHVC", "record": "GHSA-4488-HMFW-WHVC", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-02T16:17:46.650Z", "date_only": false, "value": "2026-11-02T16:17:46.650", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99223", "record": "FKIE_CVE-2026-99223", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T16:27:05.142Z", "date_only": false, "value": "2026-11-02T16:27:05.142373Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117547756029049262", "record": "CVE-2026-99223", "field": "creation_timestamp", "uuid": "6a336409-e759-44b5-a2a9-7114037c71ae", "content": "CVE-2026-99223 keys: make keyring indexes independent of kernel addresses In the Linux kernel, the following vulnerability has been resolved:\nkeys: make keyring indexes independent of kernel addresses\nKEYCTL_READ returns the serial numbers in a keyring in associative-arraytraversal order.  The first word of the index is a public, deterministichash of the type pointer, domain pointer and description.  An unprivilegeduser can therefore insert keys with known descriptions, predict theirorder for each possible KASLR slide, and recover the kernel image address.On an x86-64 build with 16 MiB alignment, 45 user keys suffice todistinguish the candidate slides.\nRemove the addresses from the whole index, not just its first hash word.Assign each key type and domain a nonzero 64-bit ID and hash those IDs andthe description with a once-initialized SipHash key.  Use the full IDs inthe later index chunks as well.  Truncating or hashing the IDs there wouldlose the guarantee that distinct type/domain/description tuples have adiffering index bit.\nAllocate IDs lazily since private key types need not be registered.  Cachethem in the index key so tree walks and copies of an existing index do notneed to dereference a type descriptor that may have been unregistered.Keep the 32-bit chunk layout and diff_objects() bit offsets consistent,and retain the separate root slot for keyrings used by recursive search.The key comparison, permissions and userspace data format are unchanged;only the address-dependent in-memory ordering is replaced.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99223https://git.kernel.org/stable/c/9ebe824d55983c9f063a2c9ef1a08b29812d406fhttps://git.kernel.org/stable/c/e108b22999edbc6f431466baf6b2016c19b7ed31https://git.kernel.org/stable/c/9f084ef0beb68091e96ab96f0e95579aac8a77f9https://git.kernel.org/stable/c/8451d4a4c43127c3b9fdf9fc9ff3fea5539a61f9https://git.kernel.org/stable/c/13fc051269d670810d9e314061b61c6dd06116a0https://git.kernel.org/stable/c/61ac0585d9f4344d3dfb84b5edff1fee7d532897https://git.kernel.org/stable/c/84f7c699f8d139f743c7dc11ef41d085690955bbhttps://git.kernel.org/stable/c/a113eba06bd1183c614d7994864d6e7054140cb9#kernel #Linux#CVE_2026_99223#bot", "url": "https://infosec.exchange/users/cve/statuses/117547756029049262"}, {"timestamp": "2026-11-02T18:32:26Z", "date_only": false, "value": "2026-11-02T18:32:26Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4488-HMFW-WHVC", "record": "GHSA-4488-HMFW-WHVC", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T00:00:00Z", "date_only": false, "value": "2026-11-03T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99223", "record": "UBUNTU-CVE-2026-99223", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T00:00:00Z", "date_only": false, "value": "2026-11-03T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99223", "record": "UBUNTU-CVE-2026-99223", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T19:12:57.119Z", "date_only": false, "value": "2026-11-03T19:12:57.119Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99223", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-03T19:12:57.119Z", "date_only": false, "value": "2026-11-03T19:12:57.119Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99223", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-03T20:18:27.673Z", "date_only": false, "value": "2026-11-03T20:18:27.673", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99223", "record": "FKIE_CVE-2026-99223", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-03T21:32:00Z", "date_only": false, "value": "2026-11-03T21:32:00Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4488-HMFW-WHVC", "record": "GHSA-4488-HMFW-WHVC", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-05T05:01:16.950Z", "anchors": {"origin": {"timestamp": "2026-11-02T16:06:33.408Z", "date_only": false, "value": "2026-11-02T16:06:33.408Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99223", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-02T16:06:33.408Z", "date_only": false, "value": "2026-11-02T16:06:33.408Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99223", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 219283.542619, "hours": 60.91209517194445, "days": 2.538003965497685, "min_seconds": 219283.542619, "max_seconds": 219283.542619, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-02T16:06:33.408Z", "date_only": false, "value": "2026-11-02T16:06:33.408Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99223", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-05T05:01:16.950Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}