CVE-2026-99221 keys/trusted_keys: return immediately after TPM unseal failure

In the Linux kernel, the following vulnerability has been resolved: keys/trustedkeys: return immediately after TPM unseal failure trustedtpmunseal proceeds to pcrlock when the TPM unseal operation fails. If pcrlock succeeds, its return value overwrites the unseal error, causing key instantiation ...

CVE-2026-99221 keys/trusted_keys: return immediately after TPM unseal failure

In the Linux kernel, the following vulnerability has been resolved: keys/trustedkeys: return immediately after TPM unseal failure trustedtpmunseal proceeds to pcrlock when the TPM unseal operation fails. If pcrlock succeeds, its return value overwrites the unseal error, causing key instantiation ...

CVE-2026-99221

The Linux kernel contains a vulnerability in the keys/trusted_keys component. Specifically, the trusted_tpm_unseal() function incorrectly proceeds to call pcrlock() even if a TPM unseal operation fails. If pcrlock() succeeds, its return value overwrites the original unseal error, leading to succe...

CVE-2026-99222 keys: Protect the read method check against type removal

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal keyctlreadkey checks key-type-read without holding key-sem. A reference keeps the key alive, but does not pin the module containing its type. A surviving RxRPC key can...

CVE-2026-99222 keys: Protect the read method check against type removal

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal keyctlreadkey checks key-type-read without holding key-sem. A reference keeps the key alive, but does not pin the module containing its type. A surviving RxRPC key can...

CVE-2026-99222

The Linux kernel contains a vulnerability in the key management system where keyctl_read_key() performs a method check on key->type->read without holding the key->sem semaphore. This allows a race condition where a surviving RxRPC key can be read while the AF_RXRPC module is being unload...

EUVD-2026-115264

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal keyctlreadkey checks key-type-read without holding key-sem. A reference keeps the key alive, but does not pin the module containing its type. A surviving RxRPC key can...

EUVD-2026-115263

In the Linux kernel, the following vulnerability has been resolved: keys/trustedkeys: return immediately after TPM unseal failure trustedtpmunseal proceeds to pcrlock when the TPM unseal operation fails. If pcrlock succeeds, its return value overwrites the unseal error, causing key instantiation ...

CVE-2026-99220 asymmetric_keys: reject trust keys without IDs

In the Linux kernel, the following vulnerability has been resolved: asymmetrickeys: reject trust keys without IDs The PKCS8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon unconditionally dereferences that slot when a PKCS8 key is supplied to a keyorkeyring...

CVE-2026-99218 coredump: hold RCU while releasing parked threads

In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredumpfinish releases the parked threads by clearing -task in their corethread entry and calling wakeupprocess on each of them. It does that without holding a reference on the...

CVE-2026-99220

The Linux kernel is vulnerable to a NULL pointer dereference in the key_or_keyring_common() function located within crypto/asymmetric_keys/restrict.c. The root cause is that the PKCS#8 parser leaves the asym_key_ids payload slot empty, but the kernel unconditionally dereferences this slot when a ...

CVE-2026-99219 ftrace: Initialize modname and offset in print_rec()

In the Linux kernel, the following vulnerability has been resolved: ftrace: Initialize modname and offset in printrec printrec leaves 'modname' and 'offset' uninitialized and kallsymslookup only sets them on success. When the lookup fails like when a module is being loaded or unloaded, 'modname'...

EUVD-2026-115261

In the Linux kernel, the following vulnerability has been resolved: ftrace: Initialize modname and offset in printrec printrec leaves 'modname' and 'offset' uninitialized and kallsymslookup only sets them on success. When the lookup fails like when a module is being loaded or unloaded, 'modname'...

EUVD-2026-115262

In the Linux kernel, the following vulnerability has been resolved: asymmetrickeys: reject trust keys without IDs The PKCS8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon unconditionally dereferences that slot when a PKCS8 key is supplied to a keyorkeyring...

CVE-2026-99219 ftrace: Initialize modname and offset in print_rec()

In the Linux kernel, the following vulnerability has been resolved: ftrace: Initialize modname and offset in printrec printrec leaves 'modname' and 'offset' uninitialized and kallsymslookup only sets them on success. When the lookup fails like when a module is being loaded or unloaded, 'modname'...

CVE-2026-99218 coredump: hold RCU while releasing parked threads

In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredumpfinish releases the parked threads by clearing -task in their corethread entry and calling wakeupprocess on each of them. It does that without holding a reference on the...

CVE-2026-99218

The Linux kernel contains a vulnerability in the coredump subsystem. The coredump_finish() function attempts to release parked threads by clearing ->task in their core_thread entry and calling wake_up_process() without holding a task reference or being inside RCU . This creates a race conditio...

CVE-2026-99219

The Linux kernel contains a vulnerability in the ftrace component where the print_rec() function leaves the modname and offset variables uninitialized. Because kallsyms_lookup() only populates these variables on success, a failed lookup (e.g., during module loading or unloading) results in modnam...

CVE-2026-99220 asymmetric_keys: reject trust keys without IDs

In the Linux kernel, the following vulnerability has been resolved: asymmetrickeys: reject trust keys without IDs The PKCS8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon unconditionally dereferences that slot when a PKCS8 key is supplied to a keyorkeyring...

EUVD-2026-115260

In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredumpfinish releases the parked threads by clearing -task in their corethread entry and calling wakeupprocess on each of them. It does that without holding a reference on the...