CVE-2026-99224
Received Received - Intake

Use-After-Free in Linux Kernel Key Management

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: keys: Protect the type name while describing a key keyctl_describe_key() must keep the key type's name alive until kasprintf() has consumed it. The retained key reference keeps the key and its description alive, but does not pin the module providing its type. The name is passed to kasprintf() without holding key->sem. kvasprintf() uses the saved name pointer in two formatting passes, with a GFP_KERNEL allocation between them. With AF_RXRPC=m, a task that passes View permission before type retirement can overlap a privileged module unload in this order: 1. KEYCTL_DESCRIBE looks up the key, saves key->type->name in the kasprintf() arguments and completes the first formatting pass. 2. While the formatter is delayed before its second pass, af_rxrpc_exit() calls unregister_key_type(), which removes the type from the registry and waits for key_gc_keytype(). 3. The collector takes key->sem for writing, retypes the retained key to key_type_dead and completes retirement. Unregistration and module exit return, allowing free_module() to release the type and name. 4. The formatter resumes its second pass and reads the saved name from released module storage, which can fault in string(). Hold key->sem for reading across kasprintf(). The collector then cannot retype the key or complete retirement until both formatting passes have finished. If retirement wins the lock first, formatting uses the core key_type_dead name instead. Release the semaphore immediately after kasprintf(), including on allocation failure, before copying to userspace. Oops report as below: BUG: unable to handle page fault for address: fffffbfff8054794 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page RIP: 0010:string+0x23f/0x470 Call Trace: vsnprintf+0x330/0x1110

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-99224

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7
Linux Linux aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7
Linux Linux aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7
Linux Linux aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7
Linux Linux aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7
Linux Linux aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7
Linux Linux aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7
Linux Linux aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7
Linux Linux 3.18

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the keyctl_describe_key() function. It occurs when the function attempts to use a key type's name after the module providing that type has been unloaded. The issue arises because the name pointer is used in two formatting passes with a memory allocation in between, during which the module could be unloaded, leading to a use-after-free scenario.

Detection Guidance

This vulnerability is specific to the Linux kernel and requires kernel-level detection. Monitor kernel logs for page faults or oops reports related to string() or keyctl operations. Check for crashes during key type operations or module unloads. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow a local attacker to cause a kernel crash or execute arbitrary code with elevated privileges. It may lead to system instability, denial of service, or unauthorized access depending on the attacker's goals and system configuration.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a Linux kernel issue involving memory access and module unloading, which could lead to system instability or crashes but does not inherently impact data protection or privacy requirements.

Mitigation Strategies

Apply the latest Linux kernel security patches immediately. Avoid unloading kernel modules while key operations are in progress. Restrict access to keyctl commands to trusted users. Monitor for crashes or faults in kernel logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99224. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...