CVE-2026-99226 keys: Avoid the owner account dereference in named keyring lookup

In the Linux kernel, the following vulnerability has been resolved: keys: Avoid the owner account dereference in named keyring lookup Named keyring lookup must keep the storage containing the owner UID alive through the namespace mapping check. findkeyringbyname reads keyring-user-uid under...

CVE-2026-99226 keys: Avoid the owner account dereference in named keyring lookup

In the Linux kernel, the following vulnerability has been resolved: keys: Avoid the owner account dereference in named keyring lookup Named keyring lookup must keep the storage containing the owner UID alive through the namespace mapping check. findkeyringbyname reads keyring-user-uid under...

CVE-2026-99226

The Linux kernel contains a vulnerability in the named keyring lookup function find_keyring_by_name(). The root cause is a use-after-free (confirmed by KASAN reports) where the function reads keyring->user->uid while holding keyring_name_lock. Because this lock only protects the keyring's n...

EUVD-2026-115268

In the Linux kernel, the following vulnerability has been resolved: keys: Avoid the owner account dereference in named keyring lookup Named keyring lookup must keep the storage containing the owner UID alive through the namespace mapping check. findkeyringbyname reads keyring-user-uid under...

CVE-2026-99224

The Linux kernel contains a vulnerability in the keys subsystem where keyctl_describe_key() fails to keep the key type's name alive during processing. Specifically, the name is passed to kasprintf() without holding key->sem , leading to a potential page fault (supervisor read access) if a priv...

EUVD-2026-115267

In the Linux kernel, the following vulnerability has been resolved: keys: Check the authorization payload in process keyring searches An authorization payload and its saved credentials must remain valid while searchprocesskeyringsrcu searches the requestor's keyrings. The function validates the...

CVE-2026-99225 keys: Check the authorization payload in process keyring searches

In the Linux kernel, the following vulnerability has been resolved: keys: Check the authorization payload in process keyring searches An authorization payload and its saved credentials must remain valid while searchprocesskeyringsrcu searches the requestor's keyrings. The function validates the...

CVE-2026-99224 keys: Protect the type name while describing a key

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the type name while describing a key keyctldescribekey must keep the key type's name alive until kasprintf has consumed it. The retained key reference keeps the key and its description alive, but does not pin the...

EUVD-2026-115266

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the type name while describing a key keyctldescribekey must keep the key type's name alive until kasprintf has consumed it. The retained key reference keeps the key and its description alive, but does not pin the...

CVE-2026-99225 keys: Check the authorization payload in process keyring searches

In the Linux kernel, the following vulnerability has been resolved: keys: Check the authorization payload in process keyring searches An authorization payload and its saved credentials must remain valid while searchprocesskeyringsrcu searches the requestor's keyrings. The function validates the...

CVE-2026-99224 keys: Protect the type name while describing a key

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the type name while describing a key keyctldescribekey must keep the key type's name alive until kasprintf has consumed it. The retained key reference keeps the key and its description alive, but does not pin the...

CVE-2026-99225

The Linux kernel contains a vulnerability in the keys subsystem where a NULL pointer dereference can occur during process keyring searches. The issue arises because the search_process_keyrings_rcu() function fails to ensure that the authorization payload remains valid during its RCU read-side sec...

CVE-2026-99223 keys: make keyring indexes independent of kernel addresses

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring indexes independent of kernel addresses KEYCTLREAD returns the serial numbers in a keyring in associative-array traversal order. The first word of the index is a public, deterministic hash of the type pointer,...

EUVD-2026-115265

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring indexes independent of kernel addresses KEYCTLREAD returns the serial numbers in a keyring in associative-array traversal order. The first word of the index is a public, deterministic hash of the type pointer,...

CVE-2026-99223

The Linux kernel is affected by a vulnerability where the KEYCTL_READ operation returns serial numbers in an associative-array traversal order. Because the first word of the index is a public, deterministic hash of the type pointer, domain pointer, and description, an unprivileged user can insert...

CVE-2026-99223 keys: make keyring indexes independent of kernel addresses

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring indexes independent of kernel addresses KEYCTLREAD returns the serial numbers in a keyring in associative-array traversal order. The first word of the index is a public, deterministic hash of the type pointer,...

CVE-2026-99221 keys/trusted_keys: return immediately after TPM unseal failure

In the Linux kernel, the following vulnerability has been resolved: keys/trustedkeys: return immediately after TPM unseal failure trustedtpmunseal proceeds to pcrlock when the TPM unseal operation fails. If pcrlock succeeds, its return value overwrites the unseal error, causing key instantiation ...

CVE-2026-99221

The Linux kernel contains a vulnerability in the keys/trusted_keys component. Specifically, the trusted_tpm_unseal() function incorrectly proceeds to call pcrlock() even if a TPM unseal operation fails. If pcrlock() succeeds, its return value overwrites the original unseal error, leading to succe...

CVE-2026-99221 keys/trusted_keys: return immediately after TPM unseal failure

In the Linux kernel, the following vulnerability has been resolved: keys/trustedkeys: return immediately after TPM unseal failure trustedtpmunseal proceeds to pcrlock when the TPM unseal operation fails. If pcrlock succeeds, its return value overwrites the unseal error, causing key instantiation ...

CVE-2026-99222 keys: Protect the read method check against type removal

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal keyctlreadkey checks key-type-read without holding key-sem. A reference keeps the key alive, but does not pin the module containing its type. A surviving RxRPC key can...