Live › vulnerability › CVE-2026-99220
A flaw in the Linux kernel's asymmetric key handling lets a local user supply a PKCS#8 key to a key-ring restriction and trigger a NULL pointer dereference. The result is a kernel crash (panic) on the machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
A Linux machine whose kernel has the PKCS#8 asymmetric key parser and lacks the fix can be panicked by any local user who can call add_key and KEYCTL_RESTRICT_KEYRING, which is normally every user. Multi-tenant hosts, shared build servers and container hosts are the most exposed. The report describes a crash (denial of service) only; no exploitation or public proof of concept was seen. Single-user machines with no untrusted local code, and kernels built without the PKCS#8 parser, can skip it, but the exact affected version range is not stated in the sources.
No product ranges from the sources yet.
uname -r and check your distribution's kernel changelog or tracker for CVE-2026-99220 or the commit 9695df3b1db4 (stable 2a40bdd44095).grep PKCS8 /boot/config-$(uname -r) for CONFIG_PKCS8_PRIVATE_KEY_PARSER) and local users who can call add_key and keyctl restrict_keyring, which is the default on most systems.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
asymmetric_keys: reject trust keys without IDs
The PKCS#8 parser deliberately leaves the asym_key_ids payload slot empty. key_or_keyring_common() unconditionally dereferences that slot when a PKCS#8 key is supplied to a key_or_keyring restriction. Both the plain and :chain forms reach this branch, allowing an unprivileged caller to trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING followed by add_key().
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279) Call Trace: <TASK> __key_create_or_update (security/keys/key.c:884) key_create_or_update (security/keys/key.c:1021) __do_sys_add_key (security/keys/keyctl.c:134) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Kernel panic - not syncing: Fatal exception
Reject an asymmetric restriction key without key IDs. A PKCS#8 private key cannot identify the signer of a candidate certificate and is not a valid trust anchor.
This page as .md · .json · in your agent: get_signal("CVE-2026-99220")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.