{"id":"CVE-2026-99245","kind":"vulnerability","aliases":["CVE-2026-99245"],"related":[],"title":"Linux kernel: keyring restriction race lets rejected keys link","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: Fix key_reject_and_link() race with keyring restriction\n\nThe restrict_link check in key_reject_and_link() is done before taking\nthe keyring semaphore, racing with a concurrent keyring_restrict()\nthat installs the restriction while holding the semaphore in write\nmode.\n\nMove the check to after __key_link_lock(), so it is done under the\nsemaphore, matching the pattern used in __key_create_or_update().","summary":"A race in the Linux kernel's key management code can let a key link into a keyring even when a restriction was meant to reject it. The sources do not state what an attacker gains beyond bypassing that keyring restriction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel-keyring","linux-kernel","runtime"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T12:17:30+00:00","first_seen_at":"2026-11-03T12:20:38+00:00","triaged_at":"2026-11-03T12:23:02+00:00","updated_at":"2026-11-03T12:23:02+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-03T12:23:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: keyring restriction race lets rejected keys link","impact":"medium","summary":"A race in the Linux kernel's key management code can let a key link into a keyring even when a restriction was meant to reject it. The sources do not state what an attacker gains beyond bypassing that keyring restriction.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","kernel-keyring"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown keyring restriction bypass; exact impact not stated","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges, the exact impact, and whether an unprivileged local user can trigger the race.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Systems running a Linux kernel version that includes the unfixed key_reject_and_link() code path; the sources do not name affected versions or how the restriction is used. Hosts that do not use keyring restrictions are likely less exposed, but the sources do not confirm this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000648,"input_tokens":4186,"output_tokens":458,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-99245':12A,15A 'attack':57B 'beyond':59B 'bypass':60B 'check':87C,119C 'code':32B 'concurr':103C 'creat':138C 'cve':10A,13A 'done':94C,128C 'even':41B 'fix':75C 'follow':69C 'gain':58B 'hold':111C 'instal':107C 'kernel':2A,17B,21B,28B,67C 'kernel-keyr':16B 'key':8A,30B,36B,74C,76C,89C,122C,137C 'keyr':3A,18B,40B,62B,82C,98C,104C 'let':6A,34B 'link':9A,37B,79C,86C,92C,123C 'linux':1A,20B,27B,66C 'linux-kernel':19B 'lock':124C 'manag':31B 'match':132C 'meant':46B 'mode':116C 'move':117C 'pattern':134C 'race':5A,24B,80C,100C 'reject':7A,48B,77C,90C 'resolv':73C 'restrict':4A,44B,63B,83C,85C,105C,109C 'runtim':22B 'semaphor':99C,113C,131C 'sourc':51B 'state':54B 'take':96C 'updat':140C 'use':135C 'vulner':70C 'write':115C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel version that includes the unfixed key_reject_and_link() code path; the sources do not name affected versions or how the restriction is used. Hosts that do not use keyring restrictions are likely less exposed, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["kernelkeyring","linuxkernel","runtime","unknown"],"first_public_at":"2026-11-03T12:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99245","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99245","severity":null,"published_at":"2026-11-03T12:17:30+00:00","modified_at":"2026-11-03T12:17:30+00:00","first_seen_at":"2026-11-03T12:20:38+00:00","fetched_at":"2026-11-03T12:20:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}