CVE-2026-63823
Received Received - Intake

Use-After-Free in Linux Kernel Key Management

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payload in instantiate paths A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ ========================= create auth key store rka in auth key wait for helper get auth key load rka from auth key copy user payload sleep on #PF helper completed detach and free rka destroy auth key wake up use rka->target_key **USE-AFTER-FREE** Give request_key_auth payloads a refcount. Take a payload reference while authkey->sem stabilizes the payload and revocation state. Hold that reference across the instantiate and reject paths. Drop the auth key owning reference from revoke and destroy. [jarkko: Replaced the first two paragraphs of text with an actual concurrency scenario.]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63823
EUVD
EUVD-2026-45489

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's key management subsystem. It occurs when a request_key_auth payload is used after being freed, due to improper reference counting. The issue arises during concurrent operations where a helper thread detaches and frees the payload while another thread attempts to use it, leading to potential memory corruption or crashes.

Detection Guidance

This vulnerability involves a use-after-free in the Linux kernel's key management subsystem. Detection requires kernel-level monitoring for crashes or memory corruption related to key handling. Check kernel logs for oops or panic messages after key operations. Use tools like ftrace, kprobes, or eBPF to trace key-related syscalls (e.g., request_key, keyctl). Monitor for unexpected behavior during key instantiation or revocation.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a kernel crash or execute arbitrary code with elevated privileges. It may lead to denial-of-service conditions or enable privilege escalation attacks on affected systems running vulnerable Linux kernel versions.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the use-after-free vulnerability in the keys subsystem. Monitor kernel logs for crashes or unusual behavior related to key management.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63823. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart