CVE-2026-64015 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
security/keys: fix missed RCU read section on lookup
Nicholas Carlini reports that the keyring code calls assoc_array_find() in find_key_to_update() without holding the RCU read lock, while the assoc_array_gc() code really is designed around removing the node from the tree and then freeing it after an RCU grace-period.
The regular key handling doesn't see this because holding the keyring semaphore hides any lifetime issues, but the persistent key handling uses a different model.
Instead of extending the keyring locking, just do the simple RCU locking that the assoc_array was designed for.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability resides in the Linux kernel's security key management subsystem, specifically within the keyring implementation that handles persistent keys. The issue stems from improper RCU (Read-Copy-Update) locking practices during key lookup operations, creating a potential race condition that could lead to memory corruption or system instability. The flaw manifests when the keyring code invokes assoc_array_find() within find_key_to_update() without acquiring the necessary RCU read lock, while the underlying assoc_array_gc() function expects nodes to be removed from the tree before being freed after an RCU grace period.
The technical implementation problem occurs because the assoc_array data structure is designed with specific locking requirements that ensure safe concurrent access patterns. When persistent key handling bypasses the standard keyring semaphore protection used in regular key operations, it exposes a path where assoc_array_find() can be called without proper RCU read lock acquisition. This creates a scenario where a node might be freed by assoc_array_gc() while another thread is still accessing it through the lookup operation, leading to potential use-after-free conditions or memory corruption.
The operational impact of this vulnerability extends beyond typical kernel stability concerns as it affects the core security infrastructure that manages cryptographic keys and credentials. Attackers could potentially exploit this race condition to corrupt kernel memory structures, escalate privileges, or cause denial of service conditions. The vulnerability is particularly concerning because it operates at the kernel level where such flaws can compromise the entire system security model and affect all applications relying on keyring services for credential management.
The fix implemented addresses the root cause by applying the correct RCU locking pattern that the assoc_array data structure was specifically designed to support, rather than extending existing keyring locking mechanisms. This approach aligns with established kernel development practices and maintains the integrity of the underlying data structure design. The solution follows CWE-362 principles for concurrent access control and addresses potential ATT&CK techniques related to privilege escalation through kernel memory corruption. Organizations should prioritize applying this patch as it resolves a fundamental race condition that could be exploited to undermine system security foundations, particularly in environments where persistent key management is heavily utilized. The fix ensures proper synchronization between key lookup operations and garbage collection processes while maintaining performance characteristics of the keyring subsystem.