CVE-2026-99225 - Vulnerability Details

- keys: Check the authorization payload in process keyring searches

Description

In the Linux kernel, the following vulnerability has been resolved:

keys: Check the authorization payload in process keyring searches

An authorization payload and its saved credentials must remain valid
while search_process_keyrings_rcu() searches the requestor's keyrings.
The function validates the authorization key, then separately loads
payload.data[0] and unconditionally reads rka->cred. Validation does
not prevent request_key_auth_revoke() from clearing the payload.

A request-key helper can assume authority and fork a descendant that
inherits the authorization key. If the descendant misses in its own
keyrings, it falls back to the saved requestor credentials. Successful
target instantiation invalidates the authorization key without clearing
the payload. After the helper exits, UMH_WAIT_PROC returns to the
requester, which calls complete_request_key() and revokes that key.

With the descendant paused after validation, the paths can interleave
as follows:

1. The descendant enters search_process_keyrings_rcu() under RCU and
key_validate() succeeds.
2. The helper instantiates the target, invalidates the authorization
key, and exits.
3. The requester resumes from UMH_WAIT_PROC, calls
complete_request_key(), and revokes the authorization key.
request_key_auth_revoke() sets its payload pointer to NULL.
4. The descendant loads NULL and dereferences rka->cred.

This NULL dereference can oops the kernel. RCU delays payload disposal
but does not prevent the pointer from being cleared.

Load the payload with dereference_key_rcu() and require a non-NULL
result before validating the authorization key and searching its saved
credentials. A non-NULL payload and its credentials remain alive for
the caller's RCU read-side section; a cleared payload skips the fallback
search and follows the existing error selection.

KASAN report as below:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
RIP: 0010:search_process_keyrings_rcu+0x32b/0x790

Published: 2026-11-02

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel contains a race condition that can cause a NULL pointer dereference while searching process keyrings. When an authorization payload is validated, a request‑key helper may concurrently invalidate the payload. If the payload is cleared while another thread still holds a reference, that thread dereferences a NULL pointer and causes a kernel oops, resulting in a crash and denial of service.

Affected Systems

The vulnerability affects all Linux kernels unless the patch that loads the payload with dereference_key_rcu and enforces a non‑NULL result is present. Distribution vendors have applied this fix in recent kernel releases; administrators should verify that their installed kernel contains the commit.

Risk and Exploitability

There is no EPSS score available, so attack frequency is uncertain. The potential to trigger a kernel crash gives the flaw high severity from a stability perspective. Based on the description, exploitation requires a locally privileged context and careful timing between a request‑key helper and its descendant process. Though it is not currently listed in KEV, the presence of a kernel crash warrants immediate attention.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e59428f721ee096d8a020504ea908a6f0d952735`	affected	< 14fb6fad526b35a7ebd121f1dd313abe652e0aa6
`e59428f721ee096d8a020504ea908a6f0d952735`	affected	< 458cf9715af6aff3ac8d2ec60bd59e9d6236fd0f
`e59428f721ee096d8a020504ea908a6f0d952735`	affected	< 7d3d2fffe933e538472ccafe5bbc7109488b9ce3
`e59428f721ee096d8a020504ea908a6f0d952735`	affected	< 26949c2e4c461e9e620e935bc22717f36a40b615
`e59428f721ee096d8a020504ea908a6f0d952735`	affected	< 984a178d54515779a1bee100b92a6cee8777c830
`e59428f721ee096d8a020504ea908a6f0d952735`	affected	< b86db7993051d05810601654e886a1e78e1fa495
`e59428f721ee096d8a020504ea908a6f0d952735`	affected	< b4dfda438fee3c6faa15d9b421c373de6a0e476f
`e59428f721ee096d8a020504ea908a6f0d952735`	affected	< 49f4e768540d25d8852ef750313afda6a4774871

Linux

affected

Version	Status	Constraints
`5.3`	affected	—
`0`	unaffected	< 5.3
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.161`	unaffected	≤ 6.6.*
`6.12.115`	unaffected	≤ 6.12.*
`6.18.60`	unaffected	≤ 6.18.*
`7.2.14`	unaffected	≤ 7.2.*
`7.3.1`	unaffected	≤ 7.3.*

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[e59428f721ee096d8a020504ea908a6f0d952735,14fb6fad526b35a7ebd121f1dd313abe652e0aa6)`	affected	code_commit	—
`[e59428f721ee096d8a020504ea908a6f0d952735,458cf9715af6aff3ac8d2ec60bd59e9d6236fd0f)`	affected	code_commit	—
`[e59428f721ee096d8a020504ea908a6f0d952735,7d3d2fffe933e538472ccafe5bbc7109488b9ce3)`	affected	code_commit	—
`[e59428f721ee096d8a020504ea908a6f0d952735,26949c2e4c461e9e620e935bc22717f36a40b615)`	affected	code_commit	—
`[e59428f721ee096d8a020504ea908a6f0d952735,984a178d54515779a1bee100b92a6cee8777c830)`	affected	code_commit	—
`[e59428f721ee096d8a020504ea908a6f0d952735,b86db7993051d05810601654e886a1e78e1fa495)`	affected	code_commit	—
`[e59428f721ee096d8a020504ea908a6f0d952735,b4dfda438fee3c6faa15d9b421c373de6a0e476f)`	affected	code_commit	—
`[e59428f721ee096d8a020504ea908a6f0d952735,49f4e768540d25d8852ef750313afda6a4774871)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`5.3`	affected	generic	—
`[0,5.3)`	unaffected	generic	—
`[5.10.273,5.11.0)`	unaffected	semver	—
`[5.15.224,5.16.0)`	unaffected	semver	—
`[6.1.191,6.2.0)`	unaffected	semver	—
`[6.6.161,6.7.0)`	unaffected	semver	—
`[6.12.115,6.13.0)`	unaffected	semver	—
`[6.18.60,6.19.0)`	unaffected	semver	—
`[7.2.14,7.3.0)`	unaffected	semver	—
`[7.3.1,7.4.0)`	unaffected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[e59428f721ee096d8a020504ea908a6f0d952735,14fb6fad526b35a7ebd121f1dd313abe652e0aa6)`	affected	code_commit	—
`[e59428f721ee096d8a020504ea908a6f0d952735,458cf9715af6aff3ac8d2ec60bd59e9d6236fd0f)`	affected	code_commit	—
`[e59428f721ee096d8a020504ea908a6f0d952735,7d3d2fffe933e538472ccafe5bbc7109488b9ce3)`	affected	code_commit	—
`[e59428f721ee096d8a020504ea908a6f0d952735,26949c2e4c461e9e620e935bc22717f36a40b615)`	affected	code_commit	—
`[e59428f721ee096d8a020504ea908a6f0d952735,984a178d54515779a1bee100b92a6cee8777c830)`	affected	code_commit	—
`[e59428f721ee096d8a020504ea908a6f0d952735,b86db7993051d05810601654e886a1e78e1fa495)`	affected	code_commit	—
`[e59428f721ee096d8a020504ea908a6f0d952735,b4dfda438fee3c6faa15d9b421c373de6a0e476f)`	affected	code_commit	—
`[e59428f721ee096d8a020504ea908a6f0d952735,49f4e768540d25d8852ef750313afda6a4774871)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`5.3`	affected	generic	—
`[0,5.3)`	unaffected	generic	—
`[5.10.273,5.11.0)`	unaffected	semver	—
`[5.15.224,5.16.0)`	unaffected	semver	—
`[6.1.191,6.2.0)`	unaffected	semver	—
`[6.6.161,6.7.0)`	unaffected	semver	—
`[6.12.115,6.13.0)`	unaffected	semver	—
`[6.18.60,6.19.0)`	unaffected	semver	—
`[7.2.14,7.3.0)`	unaffected	semver	—
`[7.3.1,7.4.0)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to the latest version that includes the fix for the authorization payload race.
Avoid or limit the use of request‑key helpers that may trigger the race condition, for example by restricting privileged processes from invoking request_key.
Tune kernel crash recovery mechanisms, such as enabling kdump, to capture crash dumps for analysis and to maintain availability.

Generated by OpenCVE AI on November 2, 2026 at 19:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/14fb6fad526b35a7ebd121f1dd313abe652e0aa6
https://git.kernel.org/stable/c/26949c2e4c461e9e620e935bc22717f36a40b615
https://git.kernel.org/stable/c/458cf9715af6aff3ac8d2ec60bd59e9d6236fd0f
https://git.kernel.org/stable/c/49f4e768540d25d8852ef750313afda6a4774871
https://git.kernel.org/stable/c/7d3d2fffe933e538472ccafe5bbc7109488b9ce3
https://git.kernel.org/stable/c/984a178d54515779a1bee100b92a6cee8777c830
https://git.kernel.org/stable/c/b4dfda438fee3c6faa15d9b421c373de6a0e476f
https://git.kernel.org/stable/c/b86db7993051d05810601654e886a1e78e1fa495

History

Mon, 02 Nov 2026 20:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-415 CWE-476

Mon, 02 Nov 2026 18:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Mon, 02 Nov 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: keys: Check the authorization payload in process keyring searches An authorization payload and its saved credentials must remain valid while search_process_keyrings_rcu() searches the requestor's keyrings. The function validates the authorization key, then separately loads payload.data[0] and unconditionally reads rka->cred. Validation does not prevent request_key_auth_revoke() from clearing the payload. A request-key helper can assume authority and fork a descendant that inherits the authorization key. If the descendant misses in its own keyrings, it falls back to the saved requestor credentials. Successful target instantiation invalidates the authorization key without clearing the payload. After the helper exits, UMH_WAIT_PROC returns to the requester, which calls complete_request_key() and revokes that key. With the descendant paused after validation, the paths can interleave as follows: 1. The descendant enters search_process_keyrings_rcu() under RCU and key_validate() succeeds. 2. The helper instantiates the target, invalidates the authorization key, and exits. 3. The requester resumes from UMH_WAIT_PROC, calls complete_request_key(), and revokes the authorization key. request_key_auth_revoke() sets its payload pointer to NULL. 4. The descendant loads NULL and dereferences rka->cred. This NULL dereference can oops the kernel. RCU delays payload disposal but does not prevent the pointer from being cleared. Load the payload with dereference_key_rcu() and require a non-NULL result before validating the authorization key and searching its saved credentials. A non-NULL payload and its credentials remain alive for the caller's RCU read-side section; a cleared payload skips the fallback search and follows the existing error selection. KASAN report as below: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] RIP: 0010:search_process_keyrings_rcu+0x32b/0x790
Title		keys: Check the authorization payload in process keyring searches
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/14fb6fad526b35a7ebd121f1dd313abe652e0aa6 https://git.kernel.org/stable/c/26949c2e4c461e9e620e935bc22717f36a40b615 https://git.kernel.org/stable/c/458cf9715af6aff3ac8d2ec60bd59e9d6236fd0f https://git.kernel.org/stable/c/49f4e768540d25d8852ef750313afda6a4774871 https://git.kernel.org/stable/c/7d3d2fffe933e538472ccafe5bbc7109488b9ce3 https://git.kernel.org/stable/c/984a178d54515779a1bee100b92a6cee8777c830 https://git.kernel.org/stable/c/b4dfda438fee3c6faa15d9b421c373de6a0e476f https://git.kernel.org/stable/c/b86db7993051d05810601654e886a1e78e1fa495

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-11-02T16:06:34.759Z

Updated: 2026-11-02T16:06:34.759Z

Reserved: 2026-09-25T10:25:14.402Z

Link: CVE-2026-99225

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-02T16:17:47.047

Modified: 2026-11-02T16:17:47.047

Link: CVE-2026-99225

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-11-02T19:45:17Z

Weaknesses

CWE-415
Double Free
CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object