{"id":"CVE-2026-99220","kind":"vulnerability","aliases":["CVE-2026-99220"],"related":[],"title":"Linux kernel: keyring restriction crash lets an unprivileged user panic the system","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nasymmetric_keys: reject trust keys without IDs\n\nThe PKCS#8 parser deliberately leaves the asym_key_ids payload slot\nempty. key_or_keyring_common() unconditionally dereferences that slot\nwhen a PKCS#8 key is supplied to a key_or_keyring restriction. Both the\nplain and :chain forms reach this branch, allowing an unprivileged caller\nto trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING\nfollowed by add_key().\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279)\n Call Trace:\n  <TASK>\n  __key_create_or_update (security/keys/key.c:884)\n  key_create_or_update (security/keys/key.c:1021)\n  __do_sys_add_key (security/keys/keyctl.c:134)\n  do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  </TASK>\n Kernel panic - not syncing: Fatal exception\n\nReject an asymmetric restriction key without key IDs. A PKCS#8 private\nkey cannot identify the signer of a candidate certificate and is not a\nvalid trust anchor.","summary":"A flaw in the Linux kernel's asymmetric key handling lets a local user supply a PKCS#8 key to a key-ring restriction and trigger a NULL pointer dereference. The result is a kernel crash (panic) on the machine.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","multi-tenant","runtime","self-hosted"],"not_affected_if":["kernel-patched","no-untrusted-local-users"],"how_to_check":"- Run `uname -r` and check your distribution's kernel changelog or tracker for CVE-2026-99220 or the commit 9695df3b1db4 (stable 2a40bdd44095).\n- Exposure needs a kernel with the PKCS#8 key parser (the Fixes target is 3c58b2362ba8; check `grep PKCS8 /boot/config-$(uname -r)` for CONFIG_PKCS8_PRIVATE_KEY_PARSER) and local users who can call add_key and keyctl restrict_keyring, which is the default on most systems.\n- Also check shared hosts, CI runners and container hosts where untrusted code runs, since containers share the host kernel.","fix":"Upstream fix: commit 9695df3b1db4ac4534274d38ee16e3b9b0bf910e (asymmetric_keys: reject trust keys without IDs, applied by Herbert Xu). A stable backport, commit 2a40bdd4409567de4c2a141ac66439dc238af752, was committed by Greg Kroah-Hartman on 2026-10-30. The stable point release that contains it is not confirmed in the sources read; take a kernel from your distribution that lists CVE-2026-99220 or this commit as fixed.","status":"open","published_at":"2026-11-02T16:17:46+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","triaged_at":"2026-11-02T16:27:02+00:00","updated_at":"2026-11-02T16:29:39+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-02T16:27:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: keyring restriction crash lets an unprivileged user panic the system","impact":"low","summary":"A flaw in the Linux kernel's asymmetric key handling lets a local user supply a PKCS#8 key to a key-ring restriction and trigger a NULL pointer dereference. The result is a kernel crash (panic) on the machine.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux","kernel","self-hosted","multi-tenant"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user crashes the kernel, causing a denial of service","analyst_note":"Find the fixed kernel versions per stable branch and the upstream commit from the kernel.org or NVD references.","how_to_check":"- `uname -r` and compare against the fixed kernel release for your distribution\n- Check whether unprivileged users can call `add_key` and `KEYCTL_RESTRICT_KEYRING` (most systems allow this by default)","plain_action":"","needs_analyst":true,"not_affected_if":["kernel-patched","no-untrusted-local-users"],"who_is_affected":"Any Linux machine running a kernel without the fix can be crashed by a local user who can call the keyring syscalls, which normally every user can. Multi-tenant hosts, shared build servers and container hosts are the most exposed. The sources do not give the affected kernel version ranges.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000734,"input_tokens":4602,"output_tokens":547,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed kernel versions per stable branch and the upstream commit from the kernel.org or NVD references.","search":"'-2026':14A,17A '-99220':15A,18A '0010':169C '0x0000000000000000':166C '0x0000000000000000-0x0000000000000007':165C '0x0000000000000007':167C '0xdffffc0000000000':157C '1021':191C '130':211C '134':197C '205':175C '279':177C '52':202C '64':200C,207C '8':45B,88C,110C,228C '83':204C '884':185C 'add':145C,194C 'address':156C 'allow':129C 'anchor':245C 'arch/x86/entry/common.c':201C,203C 'arch/x86/entry/entry_64.s':210C 'asym':93C 'asymmetr':35B,79C,220C 'branch':128C 'call':178C 'caller':132C 'candid':237C 'cannot':231C 'canon':155C 'certif':238C 'chain':124C 'common':102C,173C 'crash':5A,64B 'creat':181C,187C 'crypto/asymmetric_keys/restrict.c':174C,176C 'cve':13A,16A 'deliber':90C 'deref':162C 'derefer':58B,104C,138C 'empti':98C 'entri':205C 'except':217C 'fatal':216C 'fault':150C 'flaw':29B 'follow':74C,143C 'form':125C 'general':148C 'handl':37B 'host':27B 'hwframe':209C 'id':85C,95C,225C 'identifi':232C 'kasan':158C 'kernel':2A,19B,33B,63B,72C,212C 'key':36B,46B,50B,80C,83C,94C,99C,111C,116C,146C,170C,180C,186C,195C,222C,224C,230C 'key-r':49B 'keyctl':140C 'keyr':3A,101C,118C,142C,172C 'leav':91C 'let':6A,38B 'linux':1A,20B,32B,71C 'local':40B 'machin':68B 'multi':22B 'multi-ten':21B 'non':154C 'non-canon':153C 'null':56B,136C,160C 'null-ptr-deref':159C 'oop':147C 'panic':10A,65B,213C 'parser':89C 'payload':96C 'pkcs':44B,87C,109C,227C 'plain':122C 'pointer':57B,137C 'privat':229C 'probabl':151C 'protect':149C 'ptr':161C 'rang':164C 'reach':126C 'reject':81C,218C 'resolv':78C 'restrict':4A,52B,119C,141C,221C 'result':60B 'ring':51B 'rip':168C 'runtim':24B 'security/keys/key.c':184C,190C 'security/keys/keyctl.c':196C 'self':26B 'self-host':25B 'signer':234C 'slot':97C,106C 'suppli':42B,113C 'sync':215C 'sys':193C 'syscal':199C,206C 'system':12A 'tenant':23B 'trace':179C 'trigger':54B,134C 'trust':82C,244C 'uncondit':103C 'unprivileg':8A,131C 'updat':183C,189C 'user':9A,41B 'valid':243C 'vulner':75C 'without':84C,223C","nicknames":[],"mitigations":[],"who_affected":"A Linux machine whose kernel has the PKCS#8 asymmetric key parser and lacks the fix can be panicked by any local user who can call add_key and KEYCTL_RESTRICT_KEYRING, which is normally every user. Multi-tenant hosts, shared build servers and container hosts are the most exposed. The report describes a crash (denial of service) only; no exploitation or public proof of concept was seen. Single-user machines with no untrusted local code, and kernels built without the PKCS#8 parser, can skip it, but the exact affected version range is not stated in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","kernel","linux","multitenant","runtime","selfhosted"],"first_public_at":"2026-11-02T16:17:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99220","severity":null,"published_at":"2026-11-02T16:17:46+00:00","modified_at":"2026-11-02T16:17:46+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","fetched_at":"2026-11-02T16:24:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-99220:1397","url":null,"severity":null,"published_at":"2026-11-02T16:29:39+00:00","modified_at":"2026-11-02T16:29:39+00:00","first_seen_at":"2026-11-02T16:29:39+00:00","fetched_at":"2026-11-02T16:29:39+00:00","note":"Read the patch v3 thread (Herbert Xu: applied) and the linux-stable commit; upstream commit 9695df3b1db4, stable backport 2a40bdd44095 dated 2026-10-30. Per-branch fixed versions not found in sources; left unknown, nothing marked verified. NVD page returned nothing via web-cli. No exploitation observed."}],"documents":[{"id":52870,"url":"https://lore.landau.one/lkml/20260906110152.240426-2-bestswngs@gmail.com/T/","title":"[PATCH v3] asymmetric_keys: reject trust keys without IDs (patch + Herbert Xu 'Patch applied')","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":52871,"url":"https://repo.or.cz/linux-stable.git/commit/2a40bdd4409567de4c2a141ac66439dc238af752","title":"linux-stable commit 2a40bdd44095: asymmetric_keys: reject trust keys without IDs (upstream 9695df3b1db4)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}