Live › vulnerability › CVE-2026-99225
A race in the Linux kernel's request-key path lets a request-key helper process trigger a NULL pointer dereference while searching process keyrings, which can crash the kernel. The sources describe an oops, not code execution, and do not say an attacker can gain more than a crash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
The flaw is in the kernel's key management code for request-key authorization, which runs when a helper process such as the cifs or keyctl request-key flow is used on a system. Systems that do not use request-key helpers are unlikely to hit the race, but the sources do not confirm which configurations are exposed. unknown whether an unprivileged local user can trigger it.
No product ranges from the sources yet.
uname -r and compare it against the fixed versions in the kernel stable branches once the sources provide them.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
keys: Check the authorization payload in process keyring searches
An authorization payload and its saved credentials must remain valid while search_process_keyrings_rcu() searches the requestor's keyrings. The function validates the authorization key, then separately loads payload.data[0] and unconditionally reads rka->cred. Validation does not prevent request_key_auth_revoke() from clearing the payload.
A request-key helper can assume authority and fork a descendant that inherits the authorization key. If the descendant misses in its own keyrings, it falls back to the saved requestor credentials. Successful target instantiation invalidates the authorization key without clearing the payload. After the helper exits, UMH_WAIT_PROC returns to the requester, which calls complete_request_key() and revokes that key.
With the descendant paused after validation, the paths can interleave as follows:
This NULL dereference can oops the kernel. RCU delays payload disposal but does not prevent the pointer from being cleared.
Load the payload with dereference_key_rcu() and require a non-NULL result before validating the authorization key and searching its saved credentials. A non-NULL payload and its credentials remain alive for the caller's RCU read-side section; a cleared payload skips the fallback search and follows the existing error selection.
KASAN report as below:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
RIP: 0010:search_process_keyrings_rcu+0x32b/0x790
This page as .md · .json · in your agent: get_signal("CVE-2026-99225")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.