CVE-2026-99225 in Linux
Summary
by MITRE • 11/02/2026
In the Linux kernel, the following vulnerability has been resolved:
keys: Check the authorization payload in process keyring searches
An authorization payload and its saved credentials must remain valid while search_process_keyrings_rcu() searches the requestor's keyrings. The function validates the authorization key, then separately loads payload.data[0] and unconditionally reads rka->cred. Validation does
not prevent request_key_auth_revoke() from clearing the payload.
A request-key helper can assume authority and fork a descendant that inherits the authorization key. If the descendant misses in its own keyrings, it falls back to the saved requestor credentials. Successful target instantiation invalidates the authorization key without clearing the payload. After the helper exits, UMH_WAIT_PROC returns to the requester, which calls complete_request_key() and revokes that key.
With the descendant paused after validation, the paths can interleave as follows:
1. The descendant enters search_process_keyrings_rcu() under RCU and key_validate() succeeds. 2. The helper instantiates the target, invalidates the authorization key, and exits. 3. The requester resumes from UMH_WAIT_PROC, calls complete_request_key(), and revokes the authorization key. request_key_auth_revoke() sets its payload pointer to NULL. 4. The descendant loads NULL and dereferences rka->cred.
This NULL dereference can oops the kernel. RCU delays payload disposal but does not prevent the pointer from being cleared.
Load the payload with dereference_key_rcu() and require a non-NULL result before validating the authorization key and searching its saved credentials. A non-NULL payload and its credentials remain alive for the caller's RCU read-side section; a cleared payload skips the fallback search and follows the existing error selection.
KASAN report as below:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
RIP: 0010:search_process_keyrings_rcu+0x32b/0x790
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/02/2026
The Linux kernel key management subsystem contains a critical race condition vulnerability within the process keyring search logic, specifically in the function search_process_keyrings_rcu. This flaw arises from an improper synchronization between authorization payload validation and credential access during request-key helper execution. The core issue is that while the system validates the authorization key to ensure it remains valid for the duration of a RCU read-side critical section, it fails to maintain atomicity when accessing the associated payload data and saved credentials. This lack of strict ordering allows an interleaving scenario where the authorization key can be revoked and its payload cleared by one execution path while another concurrent thread is in the middle of processing that same payload, leading to a use-after-free condition manifested as a NULL pointer dereference.
The operational mechanism involves request-key helpers which are spawned to handle specific key instantiation requests. These helpers inherit an authorization key from their parent process and may fork descendant processes if they miss matches in their own local keyrings. In such cases, the system falls back to using saved credentials associated with the original requester. The vulnerability exploits a window where the helper instantiates its target key, which triggers invalidation of the authorization key without immediately clearing the payload pointer due to RCU grace period delays. Subsequently, when the parent process resumes from waiting for the helper and calls complete_request_key(), it revokes the authorization key, causing request_key_auth_revoke() to set the payload pointer to NULL. If a descendant thread is paused after passing initial validation but before accessing rka->cred, it will attempt to dereference this now-NULL pointer upon resumption.
This race condition results in a kernel panic or general protection fault, as evidenced by KASAN reports indicating a null-ptr-deref at offset 0x28 within search_process_keyrings_rcu. The attack vector typically requires local privilege escalation capabilities or the ability to trigger specific key request operations that involve helper processes and fallback credential searches. An attacker with sufficient privileges could exploit this timing window to crash the system, leading to a denial of service against all services running on the affected kernel instance. While remote exploitation is unlikely due to the requirement for direct interaction with the key management subsystem, local users with access to create keys or trigger request-key operations can potentially destabilize the host environment.
The technical classification aligns with CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization and CWE-416: Use After Free. In terms of adversarial tactics, this vulnerability relates to ATT&CK technique T1059 Command and Scripting Interpreter if leveraged for further exploitation, though primarily it represents a stability issue under local privilege contexts. The root cause is identified as an improper handling of shared resources during concurrent RCU read-side operations where the validity check does not guarantee the persistence of dependent data structures across thread boundaries.
Mitigation strategies focus on enforcing stricter memory access patterns within the key management code path. The primary remediation involves modifying search_process_keyrings_rcu to load the payload using dereference_key_rcu, which ensures that the pointer is safely accessed and validated for non-NULL status before proceeding with authorization checks or credential lookups. By requiring a non-NULL result prior to validation, the system prevents access to freed memory regions. If the payload is found to be NULL during this initial load phase, the operation should skip the fallback search logic and follow existing error selection paths rather than attempting to dereference invalid pointers. System administrators must apply kernel updates that include these synchronization fixes to eliminate the race condition window. Regular patching of the Linux kernel is essential to maintain system integrity against such concurrency-related vulnerabilities in core subsystems like key management.