Live › vulnerability › CVE-2026-99040
Go to dashboardA race in the Linux kernel's add_key() path reads a keyring's restriction before taking the keyring lock, so a writer can link a key after the owner installed a reject-all restriction. The writer only needs write permission on the destination keyring.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel version that includes the unfixed KEYS code, particularly where keyrings use restrictions to limit which keys can be linked. Sources do not name the affected kernel version range or the fixed release.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
KEYS: Fix add_key() race with keyring restriction
__key_create_or_update() snapshots keyring->restrict_link before taking the destination keyring's semaphore. keyring_restrict() installs a restriction while holding that semaphore.
This allows a writer to observe no restriction, wait for the keyring owner to install a reject-all restriction and return successfully, and then link a key using the stale NULL snapshot. The writer only needs write permission on the destination keyring.
Move the restrict_link read after __key_link_lock() and __key_link_begin(). The read and the subsequent restriction check are then serialized with restriction installation by keyring->sem.
The race was reproduced on v7.2.8 in 19 executions where restriction installation returned before the link completed. All 19 linked the key despite the reject-all restriction. With this change, 312 executions reached the same ordering and every add_key() call failed with -EPERM.
The issue was found by manual concurrency analysis assisted by AI-based analysis and independently verified with a QEMU reproducer and kernel instrumentation.
This page as .md · .json · in your agent: get_signal("CVE-2026-99040")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.