{"metadata": {"vulnerability": "CVE-2026-99225", "count": 14, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-09-25T10:25:14.402Z", "date_only": false, "value": "2026-09-25T10:25:14.402Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99225", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-02T16:06:34.759Z", "date_only": false, "value": "2026-11-02T16:06:34.759Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99225", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-02T16:17:00Z", "date_only": false, "value": "2026-11-02T16:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99225", "record": "UBUNTU-CVE-2026-99225", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T16:17:47Z", "date_only": false, "value": "2026-11-02T16:17:47Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FM9C-Q6VV-F7QQ", "record": "GHSA-FM9C-Q6VV-F7QQ", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-02T16:17:47.047Z", "date_only": false, "value": "2026-11-02T16:17:47.047", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99225", "record": "FKIE_CVE-2026-99225", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T16:29:15.355Z", "date_only": false, "value": "2026-11-02T16:29:15.355039Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117547761310044919", "record": "CVE-2026-99225", "field": "creation_timestamp", "uuid": "7f31dff6-d532-4bd3-b747-86116a381bea", "content": "CVE-2026-99225 keys: Check the authorization payload in process keyring searches In the Linux kernel, the following vulnerability has been resolved:\nkeys: Check the authorization payload in process keyring searches\nAn authorization payload and its saved credentials must remain validwhile search_process_keyrings_rcu() searches the requestor's keyrings.The function validates the authorization key, then separately loadspayload.data[0] and unconditionally reads rka->cred. Validation doesnot prevent request_key_auth_revoke() from clearing the payload.\nA request-key helper can assume authority and fork a descendant thatinherits the authorization key. If the descendant misses in its ownkeyrings, it falls back to the saved requestor credentials. Successfultarget instantiation invalidates the authorization key without clearingthe payload. After the helper exits, UMH_WAIT_PROC returns to therequester, which calls complete_request_key() and revokes that key.\nWith the descendant paused after validation, the paths can interleaveas follows:\n  1. The descendant enters search_process_keyrings_rcu() under RCU and     key_validate() succeeds.  2. The helper instantiates the target, invalidates the authorization     key, and exits.  3. The requester resumes from UMH_WAIT_PROC, calls     complete_request_key(), and revokes the authorization key.     request_key_auth_revoke() sets its payload pointer to NULL.  4. The descendant loads NULL and dereferences rka->cred.\nThis NULL dereference can oops the kernel. RCU delays payload disposalbut does not prevent the pointer from being cleared.\nLoad the payload with dereference_key_rcu() and require a non-NULLresult before validating the authorization key and searching its savedcredentials. A non-NULL payload and its credentials remain alive forthe caller's RCU read-side section; a cleared payload skips the fallbacksearch and follows the existing error selection.\nKASAN report as below:\n    Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI    KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]    RIP: 0010:search_process_keyrings_rcu+0x32b/0x790\nhttps://www.cve.org/CVERecord?id=CVE-2026-99225https://git.kernel.org/stable/c/14fb6fad526b35a7ebd121f1dd313abe652e0aa6https://git.kernel.org/stable/c/458cf9715af6aff3ac8d2ec60bd59e9d6236fd0fhttps://git.kernel.org/stable/c/7d3d2fffe933e538472ccafe5bbc7109488b9ce3https://git.kernel.org/stable/c/26949c2e4c461e9e620e935bc22717f36a40b615https://git.kernel.org/stable/c/984a178d54515779a1bee100b92a6cee8777c830https://git.kernel.org/stable/c/b86db7993051d05810601654e886a1e78e1fa495https://git.kernel.org/stable/c/b4dfda438fee3c6faa15d9b421c373de6a0e476fhttps://git.kernel.org/stable/c/49f4e768540d25d8852ef750313afda6a4774871#kernel #Linux#CVE_2026_99225#bot", "url": "https://infosec.exchange/users/cve/statuses/117547761310044919"}, {"timestamp": "2026-11-02T18:32:26Z", "date_only": false, "value": "2026-11-02T18:32:26Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FM9C-Q6VV-F7QQ", "record": "GHSA-FM9C-Q6VV-F7QQ", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T19:12:58.334Z", "date_only": false, "value": "2026-11-03T19:12:58.334Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99225", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-03T19:12:58.334Z", "date_only": false, "value": "2026-11-03T19:12:58.334Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99225", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-03T20:18:28.023Z", "date_only": false, "value": "2026-11-03T20:18:28.023", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99225", "record": "FKIE_CVE-2026-99225", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-03T21:32:00Z", "date_only": false, "value": "2026-11-03T21:32:00Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FM9C-Q6VV-F7QQ", "record": "GHSA-FM9C-Q6VV-F7QQ", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T04:42:24Z", "date_only": false, "value": "2026-11-05T04:42:24Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99225", "record": "UBUNTU-CVE-2026-99225", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T06:06:20.735Z", "date_only": false, "value": "2026-11-05T06:06:20.735762Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99225", "record": "BELL-CVE-2026-99225", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T06:30:21.307Z", "date_only": false, "value": "2026-11-05T06:30:21.307634Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99225", "record": "BELL-CVE-2026-99225", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-06T06:45:24.695Z", "anchors": {"origin": {"timestamp": "2026-11-02T16:06:34.759Z", "date_only": false, "value": "2026-11-02T16:06:34.759Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99225", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-02T16:06:34.759Z", "date_only": false, "value": "2026-11-02T16:06:34.759Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99225", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 311929.936887, "hours": 86.64720469083333, "days": 3.610300195451389, "min_seconds": 311929.936887, "max_seconds": 311929.936887, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-02T16:06:34.759Z", "date_only": false, "value": "2026-11-02T16:06:34.759Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99225", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-06T06:45:24.695Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}