CVE-2026-99225
Received Received - Intake

Use-After-Free in Linux Kernel Keyring Subsystem

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: keys: Check the authorization payload in process keyring searches An authorization payload and its saved credentials must remain valid while search_process_keyrings_rcu() searches the requestor's keyrings. The function validates the authorization key, then separately loads payload.data[0] and unconditionally reads rka->cred. Validation does not prevent request_key_auth_revoke() from clearing the payload. A request-key helper can assume authority and fork a descendant that inherits the authorization key. If the descendant misses in its own keyrings, it falls back to the saved requestor credentials. Successful target instantiation invalidates the authorization key without clearing the payload. After the helper exits, UMH_WAIT_PROC returns to the requester, which calls complete_request_key() and revokes that key. With the descendant paused after validation, the paths can interleave as follows: 1. The descendant enters search_process_keyrings_rcu() under RCU and key_validate() succeeds. 2. The helper instantiates the target, invalidates the authorization key, and exits. 3. The requester resumes from UMH_WAIT_PROC, calls complete_request_key(), and revokes the authorization key. request_key_auth_revoke() sets its payload pointer to NULL. 4. The descendant loads NULL and dereferences rka->cred. This NULL dereference can oops the kernel. RCU delays payload disposal but does not prevent the pointer from being cleared. Load the payload with dereference_key_rcu() and require a non-NULL result before validating the authorization key and searching its saved credentials. A non-NULL payload and its credentials remain alive for the caller's RCU read-side section; a cleared payload skips the fallback search and follows the existing error selection. KASAN report as below: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] RIP: 0010:search_process_keyrings_rcu+0x32b/0x790

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-99225

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux e59428f721ee096d8a020504ea908a6f0d952735
Linux Linux e59428f721ee096d8a020504ea908a6f0d952735
Linux Linux e59428f721ee096d8a020504ea908a6f0d952735
Linux Linux e59428f721ee096d8a020504ea908a6f0d952735
Linux Linux e59428f721ee096d8a020504ea908a6f0d952735
Linux Linux e59428f721ee096d8a020504ea908a6f0d952735
Linux Linux e59428f721ee096d8a020504ea908a6f0d952735
Linux Linux e59428f721ee096d8a020504ea908a6f0d952735
Linux Linux 5.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a NULL pointer dereference in the keyring subsystem. It occurs when an authorization payload is cleared while a process is still using it. The issue arises during keyring searches where a request-key helper forks a descendant that inherits an authorization key. If the descendant pauses after validating the key but before using it, the helper can invalidate the key and exit. When the requester resumes and revokes the key, the descendant may dereference a NULL payload pointer, causing a kernel oops.

Detection Guidance

This vulnerability is specific to the Linux kernel and requires kernel-level inspection. Detection involves checking kernel logs for NULL pointer dereference errors or kernel oops messages related to keyring operations. Use commands like 'dmesg | grep -i "general protection fault"' or 'journalctl -k | grep -i "oops"' to identify such issues.

Impact Analysis

This vulnerability can cause a kernel crash (oops) on affected Linux systems. A successful exploit could lead to denial-of-service conditions, system instability, or potential privilege escalation if an attacker gains control of the process flow. Systems relying on keyring-based authentication or authorization may be particularly affected.

Compliance Impact

This vulnerability is a kernel-level issue in Linux that causes a NULL pointer dereference, leading to a kernel oops. It does not directly impact data privacy or security controls required by GDPR or HIPAA. Compliance with these standards depends on system integrity, availability, and confidentiality, which could be indirectly affected if the kernel crash disrupts services handling sensitive data.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve this issue. If patches are unavailable, consider disabling the affected keyring functionality or restricting access to request-key helpers. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99225. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...