CVE-2026-99223
Received Received - Intake

Linux Kernel Keyring Address Leak via KEYCTL_READ

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: keys: make keyring indexes independent of kernel addresses KEYCTL_READ returns the serial numbers in a keyring in associative-array traversal order. The first word of the index is a public, deterministic hash of the type pointer, domain pointer and description. An unprivileged user can therefore insert keys with known descriptions, predict their order for each possible KASLR slide, and recover the kernel image address. On an x86-64 build with 16 MiB alignment, 45 user keys suffice to distinguish the candidate slides. Remove the addresses from the whole index, not just its first hash word. Assign each key type and domain a nonzero 64-bit ID and hash those IDs and the description with a once-initialized SipHash key. Use the full IDs in the later index chunks as well. Truncating or hashing the IDs there would lose the guarantee that distinct type/domain/description tuples have a differing index bit. Allocate IDs lazily since private key types need not be registered. Cache them in the index key so tree walks and copies of an existing index do not need to dereference a type descriptor that may have been unregistered. Keep the 32-bit chunk layout and diff_objects() bit offsets consistent, and retain the separate root slot for keyrings used by recursive search. The key comparison, permissions and userspace data format are unchanged; only the address-dependent in-memory ordering is replaced.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-99223

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux b2a4df200d570b2c33a57e1ebfa5896e4bc81b69
Linux Linux b2a4df200d570b2c33a57e1ebfa5896e4bc81b69
Linux Linux b2a4df200d570b2c33a57e1ebfa5896e4bc81b69
Linux Linux b2a4df200d570b2c33a57e1ebfa5896e4bc81b69
Linux Linux b2a4df200d570b2c33a57e1ebfa5896e4bc81b69
Linux Linux b2a4df200d570b2c33a57e1ebfa5896e4bc81b69
Linux Linux b2a4df200d570b2c33a57e1ebfa5896e4bc81b69
Linux Linux b2a4df200d570b2c33a57e1ebfa5896e4bc81b69
Linux Linux 3.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in how keyring indexes are generated. The issue allows an unprivileged user to predict the order of keys in a keyring by inserting keys with known descriptions. This prediction can help recover kernel image addresses, potentially aiding in bypassing KASLR (Kernel Address Space Layout Randomization) protections. The fix involves removing kernel address dependencies from keyring indexes and using deterministic hashes instead.

Detection Guidance

This vulnerability is specific to the Linux kernel and involves keyring index exposure. Detection requires checking kernel version and keyring behavior. No direct network detection commands are applicable. Review kernel logs for unusual keyring operations or unauthorized key insertions. Use 'dmesg | grep key' or 'journalctl -k | grep key' to inspect kernel messages related to keyrings.

Impact Analysis

If exploited, this vulnerability could allow an attacker to bypass security mechanisms like KASLR, making it easier to execute further attacks such as privilege escalation or code execution. This could compromise the confidentiality, integrity, and availability of the system. Users running vulnerable Linux kernel versions are at risk.

Compliance Impact

This vulnerability allows an unprivileged user to recover kernel image addresses by predicting keyring index order, which could lead to privilege escalation or information disclosure. While not directly impacting GDPR or HIPAA compliance, such a flaw could compromise system integrity, potentially violating data protection requirements that mandate secure processing environments.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve the vulnerability. Monitor vendor advisories for kernel updates and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99223. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...