CVE-2026-99228

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99228", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.402Z", "datePublished": "2026-11-02T16:06:36.680Z", "dateUpdated": "2026-11-06T17:15:09.971Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-06T17:15:09.971Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/io-wq: don't lose the signal that ends work\n\nWhen a thread exits, only its tracked requests are cancelled. Then its\nio-wq is torn down. io_wq_exit_workers() signals every worker, to get it\nout of an interruptible sleep, and waits for all of them to exit. Before\nthey do, they go through the work that is left. Unbounded work is\ncancelled. Bounded work is run, as it is expected to end by itself.\n\nNot all of it does. An open has no file yet, so it counts as bounded, and\nthe open of a FIFO waits for the other end. That is what the signal is for.\nBut the workers are signalled once, and a worker that hasn't started the\nwork by then loses the signal:\n\n io_wq_exit_workers() io_worker_handle_work()\n io_wq_worker_wake()\n set TIF_NOTIFY_SIGNAL\n io_assign_current_work()\n io_run_task_work()\n clear TIF_NOTIFY_SIGNAL\n io_wq_submit_work()\n fifo_open()\n wait_for_partner()\n wait_for_completion_timeout()\n\nThe thread never gets out of do_exit():\n\n IORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC\n exit of the thread that has submitted it\n\nhangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is\nkilled.\n\nSet TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT\nset. The bit is set before the workers are signalled, and it is tested\nafter the flag has been cleared, with clear_notify_signal() providing the\nbarrier. So either the flag stays, or the bit is seen.\n\nWork that is started while the io-wq exits is treated like work that is\nbeing run at that time: it isn't interrupted unless it waits\ninterruptibly."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/io-wq.c"], "versions": [{"version": "afcc4015d1bf5659b8c722aff679e9b8c41ee156", "lessThan": "ddccc60f036b309430cf130d48aafed94ef7355a", "status": "affected", "versionType": "git"}, {"version": "afcc4015d1bf5659b8c722aff679e9b8c41ee156", "lessThan": "08c42055b8f9a5d29236d34ad4bce08828239fe1", "status": "affected", "versionType": "git"}, {"version": "afcc4015d1bf5659b8c722aff679e9b8c41ee156", "lessThan": "62996803c1b5f18176de255db4c843021f2d19c8", "status": "affected", "versionType": "git"}, {"version": "afcc4015d1bf5659b8c722aff679e9b8c41ee156", "lessThan": "7309fea05a3d66af9746843c43fef14c10b8141e", "status": "affected", "versionType": "git"}, {"version": "afcc4015d1bf5659b8c722aff679e9b8c41ee156", "lessThan": "fdb771015c1e13677b57a4015f0c938748f13781", "status": "affected", "versionType": "git"}, {"version": "afcc4015d1bf5659b8c722aff679e9b8c41ee156", "lessThan": "7df9a3b5eda51c512d3dd138e3b7daa525071757", "status": "affected", "versionType": "git"}, {"version": "afcc4015d1bf5659b8c722aff679e9b8c41ee156", "lessThan": "63c103279a95e82280092f2f4232e91e8117a252", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/io-wq.c"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.60", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.14", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.2", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.4-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.18.60"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "7.2.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "7.3.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "7.4-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ddccc60f036b309430cf130d48aafed94ef7355a"}, {"url": "https://git.kernel.org/stable/c/08c42055b8f9a5d29236d34ad4bce08828239fe1"}, {"url": "https://git.kernel.org/stable/c/62996803c1b5f18176de255db4c843021f2d19c8"}, {"url": "https://git.kernel.org/stable/c/7309fea05a3d66af9746843c43fef14c10b8141e"}, {"url": "https://git.kernel.org/stable/c/fdb771015c1e13677b57a4015f0c938748f13781"}, {"url": "https://git.kernel.org/stable/c/7df9a3b5eda51c512d3dd138e3b7daa525071757"}, {"url": "https://git.kernel.org/stable/c/63c103279a95e82280092f2f4232e91e8117a252"}], "title": "io_uring/io-wq: don't lose the signal that ends work", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["io_uring/io-wq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ddccc60f036b309430cf130d48aafed94ef7355a", "status": "affected", "version": "afcc4015d1bf5659b8c722aff679e9b8c41ee156", "versionType": "git"}, {"lessThan": "08c42055b8f9a5d29236d34ad4bce08828239fe1", "status": "affected", "version": "afcc4015d1bf5659b8c722aff679e9b8c41ee156", "versionType": "git"}, {"lessThan": "62996803c1b5f18176de255db4c843021f2d19c8", "status": "affected", "version": "afcc4015d1bf5659b8c722aff679e9b8c41ee156", "versionType": "git"}, {"lessThan": "7309fea05a3d66af9746843c43fef14c10b8141e", "status": "affected", "version": "afcc4015d1bf5659b8c722aff679e9b8c41ee156", "versionType": "git"}, {"lessThan": "fdb771015c1e13677b57a4015f0c938748f13781", "status": "affected", "version": "afcc4015d1bf5659b8c722aff679e9b8c41ee156", "versionType": "git"}, {"lessThan": "7df9a3b5eda51c512d3dd138e3b7daa525071757", "status": "affected", "version": "afcc4015d1bf5659b8c722aff679e9b8c41ee156", "versionType": "git"}, {"lessThan": "63c103279a95e82280092f2f4232e91e8117a252", "status": "affected", "version": "afcc4015d1bf5659b8c722aff679e9b8c41ee156", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["io_uring/io-wq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.60", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.14", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.4-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/io-wq: don't lose the signal that ends work\n\nWhen a thread exits, only its tracked requests are cancelled. Then its\nio-wq is torn down. io_wq_exit_workers() signals every worker, to get it\nout of an interruptible sleep, and waits for all of them to exit. Before\nthey do, they go through the work that is left. Unbounded work is\ncancelled. Bounded work is run, as it is expected to end by itself.\n\nNot all of it does. An open has no file yet, so it counts as bounded, and\nthe open of a FIFO waits for the other end. That is what the signal is for.\nBut the workers are signalled once, and a worker that hasn't started the\nwork by then loses the signal:\n\n io_wq_exit_workers() io_worker_handle_work()\n io_wq_worker_wake()\n set TIF_NOTIFY_SIGNAL\n io_assign_current_work()\n io_run_task_work()\n clear TIF_NOTIFY_SIGNAL\n io_wq_submit_work()\n fifo_open()\n wait_for_partner()\n wait_for_completion_timeout()\n\nThe thread never gets out of do_exit():\n\n IORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC\n exit of the thread that has submitted it\n\nhangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is\nkilled.\n\nSet TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT\nset. The bit is set before the workers are signalled, and it is tested\nafter the flag has been cleared, with clear_notify_signal() providing the\nbarrier. So either the flag stays, or the bit is seen.\n\nWork that is started while the io-wq exits is treated like work that is\nbeing run at that time: it isn't interrupted unless it waits\ninterruptibly."}], "id": "CVE-2026-99228", "lastModified": "2026-11-06T18:18:32.340", "metrics": {}, "published": "2026-11-02T16:17:47.600", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/08c42055b8f9a5d29236d34ad4bce08828239fe1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/62996803c1b5f18176de255db4c843021f2d19c8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/63c103279a95e82280092f2f4232e91e8117a252"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7309fea05a3d66af9746843c43fef14c10b8141e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7df9a3b5eda51c512d3dd138e3b7daa525071757"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ddccc60f036b309430cf130d48aafed94ef7355a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fdb771015c1e13677b57a4015f0c938748f13781"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via io_uring worker hang during thread exit", "id": "2565272", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565272"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-366", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nio_uring/io-wq: don't lose the signal that ends work\nWhen a thread exits, only its tracked requests are cancelled. Then its\nio-wq is torn down. io_wq_exit_workers() signals every worker, to get it\nout of an interruptible sleep, and waits for all of them to exit. Before\nthey do, they go through the work that is left. Unbounded work is\ncancelled. Bounded work is run, as it is expected to end by itself.\nNot all of it does. An open has no file yet, so it counts as bounded, and\nthe open of a FIFO waits for the other end. That is what the signal is for.\nBut the workers are signalled once, and a worker that hasn't started the\nwork by then loses the signal:\nio_wq_exit_workers() io_worker_handle_work()\nio_wq_worker_wake()\nset TIF_NOTIFY_SIGNAL\nio_assign_current_work()\nio_run_task_work()\nclear TIF_NOTIFY_SIGNAL\nio_wq_submit_work()\nfifo_open()\nwait_for_partner()\nwait_for_completion_timeout()\nThe thread never gets out of do_exit():\nIORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC\nexit of the thread that has submitted it\nhangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is\nkilled.\nSet TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT\nset. The bit is set before the workers are signalled, and it is tested\nafter the flag has been cleared, with clear_notify_signal() providing the\nbarrier. So either the flag stays, or the bit is seen.\nWork that is started while the io-wq exits is treated like work that is\nbeing run at that time: it isn't interrupted unless it waits\ninterruptibly.", "A flaw was found in the Linux kernel's io_uring subsystem. When an application thread exits while running asynchronous operations via internal worker queues, the signal intended to interrupt and terminate worker tasks can be lost. A local user could exploit this vulnerability by submitting asynchronous requests that block waiting for an external event, such as opening a named pipe without a peer, causing the exiting thread to hang indefinitely and leading to a Denial of Service (DoS)."], "name": "CVE-2026-99228", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-02T16:06:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99228\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99228\nhttps://git.kernel.org/stable/c/08c42055b8f9a5d29236d34ad4bce08828239fe1\nhttps://git.kernel.org/stable/c/62996803c1b5f18176de255db4c843021f2d19c8\nhttps://git.kernel.org/stable/c/7309fea05a3d66af9746843c43fef14c10b8141e\nhttps://git.kernel.org/stable/c/ddccc60f036b309430cf130d48aafed94ef7355a\nhttps://git.kernel.org/stable/c/fdb771015c1e13677b57a4015f0c938748f13781"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[afcc4015d1bf5659b8c722aff679e9b8c41ee156,ddccc60f036b309430cf130d48aafed94ef7355a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[afcc4015d1bf5659b8c722aff679e9b8c41ee156,08c42055b8f9a5d29236d34ad4bce08828239fe1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[afcc4015d1bf5659b8c722aff679e9b8c41ee156,62996803c1b5f18176de255db4c843021f2d19c8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[afcc4015d1bf5659b8c722aff679e9b8c41ee156,7309fea05a3d66af9746843c43fef14c10b8141e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[afcc4015d1bf5659b8c722aff679e9b8c41ee156,fdb771015c1e13677b57a4015f0c938748f13781)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.191,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.161,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.115,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.60,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[afcc4015d1bf5659b8c722aff679e9b8c41ee156,ddccc60f036b309430cf130d48aafed94ef7355a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[afcc4015d1bf5659b8c722aff679e9b8c41ee156,08c42055b8f9a5d29236d34ad4bce08828239fe1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[afcc4015d1bf5659b8c722aff679e9b8c41ee156,62996803c1b5f18176de255db4c843021f2d19c8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[afcc4015d1bf5659b8c722aff679e9b8c41ee156,7309fea05a3d66af9746843c43fef14c10b8141e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[afcc4015d1bf5659b8c722aff679e9b8c41ee156,fdb771015c1e13677b57a4015f0c938748f13781)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.191,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.161,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.115,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.60,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-02T17:45:12.194741+00:00", "updated": "2026-11-05T04:00:15.843168+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}