CVE-2026-99222 - Vulnerability Details

- keys: Protect the read method check against type removal

Description

In the Linux kernel, the following vulnerability has been resolved:

keys: Protect the read method check against type removal

keyctl_read_key() checks key->type->read without holding key->sem.
A reference keeps the key alive, but does not pin the module containing
its type. A surviving RxRPC key can therefore be read while AF_RXRPC
is being unloaded:

KEYCTL_READ task Module unload and key GC
---------------- ------------------------
lookup_user_key()
permission / possession checks
load key->type
af_rxrpc_exit()
unregister_key_type()
GC: down_write(key->sem)
GC: retype to key_type_dead
GC: up_write(key->sem)
unregister_key_type() returns
free_module()
read saved type's read member

The final access can read freed module storage. The read invocation in
__keyctl_read_key() is already protected by key->sem, but the earlier
method check is outside that critical section.

Move the method check into __keyctl_read_key(), after key_validate() and
under its existing read hold on key->sem. The check and invocation then
use the same protected type for length queries and every read retry.
The GC cannot retype the key until the semaphore is released, and type
unregistration waits for that GC pass before the module can be freed.

Return -EOPNOTSUPP when validation succeeds and the type has no read
method. A temporary buffer may now be allocated before this result;
allocation and copying to userspace remain outside the semaphore.

Published: 2026-11-02

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel the keyctl_read_key system call performs a type check on a key’s read method without holding the key’s semaphore. When an AF_RXRPC key exists, the corresponding key type can be unregistered while a read is pending. This race allows the read operation to access freed module storage, exposing arbitrary memory contents or causing a crash. The flaw is a classic use‑after‑free, classified as CWE‑416.

Affected Systems

All Linux kernel builds that include AF_RXRPC before the patches in the listed commits are affected. The fix, which moves the type‑check inside the semaphore‑protected section, applies to every kernel version supplied by the GNU/Linux distribution maintainers that contain the commit changes referenced in the advisory.

Risk and Exploitability

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Consequently, known exploitation probability is low, but the flaw could be triggered by a local attacker who can create or control AF_RXRPC keys. The impact is confined to the kernel’s address space and does not provide remote access without additional exploits. The absence of a CVSS score in the public data means the exact severity has not been quantified, but the use‑after‑free nature suggests a moderate to high risk for affected systems.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d3ec10aa95819bff18a0d936b18884c7816d0914`	affected	< e5f830ae6611cddbfc504c43f14155f60b63206a
`d3ec10aa95819bff18a0d936b18884c7816d0914`	affected	< ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d
`d3ec10aa95819bff18a0d936b18884c7816d0914`	affected	< 1486caee47b4909f52835a957c3293e970113e44
`d3ec10aa95819bff18a0d936b18884c7816d0914`	affected	< ff44f1b303aa76a818d898e85c56ed4852c031e2
`d3ec10aa95819bff18a0d936b18884c7816d0914`	affected	< 6a36e2a1a017c51f8a8ad2a094566bad97c46a9b
`d3ec10aa95819bff18a0d936b18884c7816d0914`	affected	< 3edc064069d07e7d37359fcb4d03d3bab15ee3ab
`d3ec10aa95819bff18a0d936b18884c7816d0914`	affected	< cf1af7df80e38bf58bd74c2cccce32fcbd1a596a
`d3ec10aa95819bff18a0d936b18884c7816d0914`	affected	< e2a2deda08d91644f5e30c17d267b1cdc5f124b2
`7fa67aa30509ad0da72ac0f757aa76e53c0ea3de`	affected	—
`18779eac17b5df9dff57138d07631573553a41d4`	affected	—
`f1afcf9488fc45765e20e2047d3b776981900e0b`	affected	—
`212d3adb1af4e34acb158d6c6def370016a1011d`	affected	—
`4.14.177`	affected	< 4.15
`4.19.118`	affected	< 4.20
`5.4.35`	affected	< 5.5
`5.6.7`	affected	< 5.7

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.161`	unaffected	≤ 6.6.*
`6.12.115`	unaffected	≤ 6.12.*
`6.18.60`	unaffected	≤ 6.18.*
`7.2.14`	unaffected	≤ 7.2.*
`7.3.1`	unaffected	≤ 7.3.*

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[d3ec10aa95819bff18a0d936b18884c7816d0914,e5f830ae6611cddbfc504c43f14155f60b63206a)`	affected	code_commit	—
`[d3ec10aa95819bff18a0d936b18884c7816d0914,ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d)`	affected	code_commit	—
`[d3ec10aa95819bff18a0d936b18884c7816d0914,1486caee47b4909f52835a957c3293e970113e44)`	affected	code_commit	—
`[d3ec10aa95819bff18a0d936b18884c7816d0914,ff44f1b303aa76a818d898e85c56ed4852c031e2)`	affected	code_commit	—
`[d3ec10aa95819bff18a0d936b18884c7816d0914,6a36e2a1a017c51f8a8ad2a094566bad97c46a9b)`	affected	code_commit	—
`[d3ec10aa95819bff18a0d936b18884c7816d0914,3edc064069d07e7d37359fcb4d03d3bab15ee3ab)`	affected	code_commit	—
`[d3ec10aa95819bff18a0d936b18884c7816d0914,cf1af7df80e38bf58bd74c2cccce32fcbd1a596a)`	affected	code_commit	—
`[d3ec10aa95819bff18a0d936b18884c7816d0914,e2a2deda08d91644f5e30c17d267b1cdc5f124b2)`	affected	code_commit	—
`7fa67aa30509ad0da72ac0f757aa76e53c0ea3de`	affected	code_commit	—
`18779eac17b5df9dff57138d07631573553a41d4`	affected	code_commit	—
`f1afcf9488fc45765e20e2047d3b776981900e0b`	affected	code_commit	—
`212d3adb1af4e34acb158d6c6def370016a1011d`	affected	code_commit	—
`[4.14.177,4.15)`	affected	semver	—
`[4.19.118,4.20)`	affected	semver	—
`[5.4.35,5.5)`	affected	semver	—
`[5.6.7,5.7)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`5.7`	affected	generic	—
`[0,5.7)`	unaffected	semver	—
`[5.10.273,5.10.*]`	unaffected	generic	—
`[5.15.224,5.15.*]`	unaffected	generic	—
`[6.1.191,6.1.*]`	unaffected	generic	—
`[6.6.161,6.6.*]`	unaffected	generic	—
`[6.12.115,6.12.*]`	unaffected	generic	—
`[6.18.60,6.18.*]`	unaffected	generic	—
`[7.2.14,7.2.*]`	unaffected	generic	—
`[7.3.1,7.3.*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[d3ec10aa95819bff18a0d936b18884c7816d0914,e5f830ae6611cddbfc504c43f14155f60b63206a)`	affected	code_commit	—
`[d3ec10aa95819bff18a0d936b18884c7816d0914,ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d)`	affected	code_commit	—
`[d3ec10aa95819bff18a0d936b18884c7816d0914,1486caee47b4909f52835a957c3293e970113e44)`	affected	code_commit	—
`[d3ec10aa95819bff18a0d936b18884c7816d0914,ff44f1b303aa76a818d898e85c56ed4852c031e2)`	affected	code_commit	—
`[d3ec10aa95819bff18a0d936b18884c7816d0914,6a36e2a1a017c51f8a8ad2a094566bad97c46a9b)`	affected	code_commit	—
`[d3ec10aa95819bff18a0d936b18884c7816d0914,3edc064069d07e7d37359fcb4d03d3bab15ee3ab)`	affected	code_commit	—
`[d3ec10aa95819bff18a0d936b18884c7816d0914,cf1af7df80e38bf58bd74c2cccce32fcbd1a596a)`	affected	code_commit	—
`[d3ec10aa95819bff18a0d936b18884c7816d0914,e2a2deda08d91644f5e30c17d267b1cdc5f124b2)`	affected	code_commit	—
`7fa67aa30509ad0da72ac0f757aa76e53c0ea3de`	affected	code_commit	—
`18779eac17b5df9dff57138d07631573553a41d4`	affected	code_commit	—
`f1afcf9488fc45765e20e2047d3b776981900e0b`	affected	code_commit	—
`212d3adb1af4e34acb158d6c6def370016a1011d`	affected	code_commit	—
`[4.14.177,4.15)`	affected	semver	—
`[4.19.118,4.20)`	affected	semver	—
`[5.4.35,5.5)`	affected	semver	—
`[5.6.7,5.7)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`5.7`	affected	generic	—
`[0,5.7)`	unaffected	semver	—
`[5.10.273,5.10.*]`	unaffected	generic	—
`[5.15.224,5.15.*]`	unaffected	generic	—
`[6.1.191,6.1.*]`	unaffected	generic	—
`[6.6.161,6.6.*]`	unaffected	generic	—
`[6.12.115,6.12.*]`	unaffected	generic	—
`[6.18.60,6.18.*]`	unaffected	generic	—
`[7.2.14,7.2.*]`	unaffected	generic	—
`[7.3.1,7.3.*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that incorporates the commit sequence fixing the use‑after‑free in keyctl_read_key.
If an upgrade cannot be performed immediately, unload or disable the AF_RXRPC kernel module to eliminate the unprotected read path until the patch is available.
For custom kernels or unmaintained builds, apply a local patch that encloses the key type check inside the key semaphore guard and returns –EOPNOTSUPP when a type lacks a read method, replicating the upstream fix.

Generated by OpenCVE AI on November 2, 2026 at 18:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1486caee47b4909f52835a957c3293e970113e44
https://git.kernel.org/stable/c/3edc064069d07e7d37359fcb4d03d3bab15ee3ab
https://git.kernel.org/stable/c/6a36e2a1a017c51f8a8ad2a094566bad97c46a9b
https://git.kernel.org/stable/c/cf1af7df80e38bf58bd74c2cccce32fcbd1a596a
https://git.kernel.org/stable/c/e2a2deda08d91644f5e30c17d267b1cdc5f124b2
https://git.kernel.org/stable/c/e5f830ae6611cddbfc504c43f14155f60b63206a
https://git.kernel.org/stable/c/ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d
https://git.kernel.org/stable/c/ff44f1b303aa76a818d898e85c56ed4852c031e2

History

Mon, 02 Nov 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Mon, 02 Nov 2026 18:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Mon, 02 Nov 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal keyctl_read_key() checks key->type->read without holding key->sem. A reference keeps the key alive, but does not pin the module containing its type. A surviving RxRPC key can therefore be read while AF_RXRPC is being unloaded: KEYCTL_READ task Module unload and key GC ---------------- ------------------------ lookup_user_key() permission / possession checks load key->type af_rxrpc_exit() unregister_key_type() GC: down_write(key->sem) GC: retype to key_type_dead GC: up_write(key->sem) unregister_key_type() returns free_module() read saved type's read member The final access can read freed module storage. The read invocation in __keyctl_read_key() is already protected by key->sem, but the earlier method check is outside that critical section. Move the method check into __keyctl_read_key(), after key_validate() and under its existing read hold on key->sem. The check and invocation then use the same protected type for length queries and every read retry. The GC cannot retype the key until the semaphore is released, and type unregistration waits for that GC pass before the module can be freed. Return -EOPNOTSUPP when validation succeeds and the type has no read method. A temporary buffer may now be allocated before this result; allocation and copying to userspace remain outside the semaphore.
Title		keys: Protect the read method check against type removal
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1486caee47b4909f52835a957c3293e970113e44 https://git.kernel.org/stable/c/3edc064069d07e7d37359fcb4d03d3bab15ee3ab https://git.kernel.org/stable/c/6a36e2a1a017c51f8a8ad2a094566bad97c46a9b https://git.kernel.org/stable/c/cf1af7df80e38bf58bd74c2cccce32fcbd1a596a https://git.kernel.org/stable/c/e2a2deda08d91644f5e30c17d267b1cdc5f124b2 https://git.kernel.org/stable/c/e5f830ae6611cddbfc504c43f14155f60b63206a https://git.kernel.org/stable/c/ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d https://git.kernel.org/stable/c/ff44f1b303aa76a818d898e85c56ed4852c031e2

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-11-02T16:06:32.844Z

Updated: 2026-11-02T16:06:32.844Z

Reserved: 2026-09-25T10:25:14.402Z

Link: CVE-2026-99222

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-02T16:17:46.460

Modified: 2026-11-02T16:17:46.460

Link: CVE-2026-99222

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-11-02T18:15:14Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object