Live › vulnerability › CVE-2026-99245
A race in the Linux kernel's key management code can let a key link into a keyring even when a restriction was meant to reject it. The sources do not state what an attacker gains beyond bypassing that keyring restriction.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 12:20 UTC. All times on this page are UTC.
Systems running a Linux kernel version that includes the unfixed key_reject_and_link() code path; the sources do not name affected versions or how the restriction is used. Hosts that do not use keyring restrictions are likely less exposed, but the sources do not confirm this.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
KEYS: Fix key_reject_and_link() race with keyring restriction
The restrict_link check in key_reject_and_link() is done before taking the keyring semaphore, racing with a concurrent keyring_restrict() that installs the restriction while holding the semaphore in write mode.
Move the check to after __key_link_lock(), so it is done under the semaphore, matching the pattern used in __key_create_or_update().
This page as .md · .json · in your agent: get_signal("CVE-2026-99245")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.