{"id":"CVE-2026-99040","kind":"vulnerability","aliases":["CVE-2026-99040"],"related":[],"title":"Linux kernel: keyring race lets add_key bypass reject-all restriction","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: Fix add_key() race with keyring restriction\n\n__key_create_or_update() snapshots keyring->restrict_link before taking\nthe destination keyring's semaphore.  keyring_restrict() installs a\nrestriction while holding that semaphore.\n\nThis allows a writer to observe no restriction, wait for the keyring\nowner to install a reject-all restriction and return successfully, and\nthen link a key using the stale NULL snapshot.  The writer only needs\nwrite permission on the destination keyring.\n\nMove the restrict_link read after __key_link_lock() and\n__key_link_begin().  The read and the subsequent restriction check are\nthen serialized with restriction installation by keyring->sem.\n\nThe race was reproduced on v7.2.8 in 19 executions where restriction\ninstallation returned before the link completed.  All 19 linked the key\ndespite the reject-all restriction.  With this change, 312 executions\nreached the same ordering and every add_key() call failed with -EPERM.\n\nThe issue was found by manual concurrency analysis assisted by AI-based\nanalysis and independently verified with a QEMU reproducer and kernel\ninstrumentation.","summary":"A race in the Linux kernel's add_key() path reads a keyring's restriction before taking the keyring lock, so a writer can link a key after the owner installed a reject-all restriction. The writer only needs write permission on the destination keyring.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel-keyring","linux-kernel"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-23T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:13+00:00","updated_at":"2026-10-25T04:54:13+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:54:13Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel: keyring race lets add_key bypass reject-all restriction","impact":"medium","summary":"A race in the Linux kernel's add_key() path reads a keyring's restriction before taking the keyring lock, so a writer can link a key after the owner installed a reject-all restriction. The writer only needs write permission on the destination keyring.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","kernel-keyring"],"confidence":0.6,"needs_auth":"yes","worst_case":"unauthorized keys get linked into a restricted keyring","analyst_note":"Find the affected kernel version range and the fixing stable commit from the NVD entry or the kernel git log for the KEYS add_key restriction fix.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel version that includes the unfixed KEYS code, particularly where keyrings use restrictions to limit which keys can be linked. Sources do not name the affected kernel version range or the fixed release.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000573,"input_tokens":3605,"output_tokens":424,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99040':15A,18A '19':193C,204C '312':217C 'add':6A,33B,84C,225C 'ai':242C 'ai-bas':241C 'allow':115C 'analysi':238C,244C 'assist':239C 'base':243C 'begin':169C 'bypass':8A 'call':227C 'chang':216C 'check':176C 'complet':202C 'concurr':237C 'creat':91C 'cve':13A,16A 'despit':208C 'destin':70B,101C,155C 'eperm':230C 'everi':224C 'execut':194C,218C 'fail':228C 'fix':83C 'follow':77C 'found':234C 'hold':111C 'independ':246C 'infrastructur':19B 'instal':56B,107C,128C,182C,197C 'instrument':254C 'issu':232C 'kernel':2A,21B,25B,31B,75C,253C 'kernel-keyr':20B 'key':7A,34B,52B,82C,85C,90C,141C,163C,167C,207C,226C 'keyr':3A,22B,38B,44B,71B,88C,95C,102C,105C,125C,156C,184C 'let':5A 'link':50B,97C,139C,160C,164C,168C,201C,205C 'linux':1A,24B,30B,74C 'linux-kernel':23B 'lock':45B,165C 'manual':236C 'move':157C 'need':65B,150C 'null':145C 'observ':119C 'order':222C 'owner':55B,126C 'path':35B 'permiss':67B,152C 'qemu':250C 'race':4A,27B,86C,187C 'reach':219C 'read':36B,161C,171C 'reject':10A,59B,131C,211C 'reject-al':9A,58B,130C,210C 'reproduc':189C,251C 'resolv':81C 'restrict':12A,40B,61B,89C,96C,106C,109C,121C,133C,159C,175C,181C,196C,213C 'return':135C,198C 'sem':185C 'semaphor':104C,113C 'serial':179C 'snapshot':94C,146C 'stale':144C 'subsequ':174C 'success':136C 'take':42B,99C 'updat':93C 'use':142C 'v7.2.8':191C 'verifi':247C 'vulner':78C 'wait':122C 'write':66B,151C 'writer':48B,63B,117C,148C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel version that includes the unfixed KEYS code, particularly where keyrings use restrictions to limit which keys can be linked. Sources do not name the affected kernel version range or the fixed release.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99040","severity":null,"published_at":"2026-10-23T13:17:27+00:00","modified_at":"2026-10-23T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}