CVE-2026-99224

The Linux kernel contains a vulnerability in the keys subsystem where keyctl_describe_key() fails to keep the key type's name alive during processing. Specifically, the name is passed to kasprintf() without holding key->sem , leading to a potential page fault (supervisor read access) if a priv...

CVE-2026-99224 keys: Protect the type name while describing a key

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the type name while describing a key keyctldescribekey must keep the key type's name alive until kasprintf has consumed it. The retained key reference keeps the key and its description alive, but does not pin the...

CVE-2026-99225

The Linux kernel contains a vulnerability in the keys subsystem where a NULL pointer dereference can occur during process keyring searches. The issue arises because the search_process_keyrings_rcu() function fails to ensure that the authorization payload remains valid during its RCU read-side sec...

CVE-2026-99224 keys: Protect the type name while describing a key

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the type name while describing a key keyctldescribekey must keep the key type's name alive until kasprintf has consumed it. The retained key reference keeps the key and its description alive, but does not pin the...

CVE-2026-99225 keys: Check the authorization payload in process keyring searches

In the Linux kernel, the following vulnerability has been resolved: keys: Check the authorization payload in process keyring searches An authorization payload and its saved credentials must remain valid while searchprocesskeyringsrcu searches the requestor's keyrings. The function validates the...

EUVD-2026-115266

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the type name while describing a key keyctldescribekey must keep the key type's name alive until kasprintf has consumed it. The retained key reference keeps the key and its description alive, but does not pin the...

CVE-2026-99225 keys: Check the authorization payload in process keyring searches

In the Linux kernel, the following vulnerability has been resolved: keys: Check the authorization payload in process keyring searches An authorization payload and its saved credentials must remain valid while searchprocesskeyringsrcu searches the requestor's keyrings. The function validates the...

CVE-2026-99223 keys: make keyring indexes independent of kernel addresses

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring indexes independent of kernel addresses KEYCTLREAD returns the serial numbers in a keyring in associative-array traversal order. The first word of the index is a public, deterministic hash of the type pointer,...

EUVD-2026-115265

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring indexes independent of kernel addresses KEYCTLREAD returns the serial numbers in a keyring in associative-array traversal order. The first word of the index is a public, deterministic hash of the type pointer,...

CVE-2026-99223

The Linux kernel is affected by a vulnerability where the KEYCTL_READ operation returns serial numbers in an associative-array traversal order. Because the first word of the index is a public, deterministic hash of the type pointer, domain pointer, and description, an unprivileged user can insert...

CVE-2026-99223 keys: make keyring indexes independent of kernel addresses

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring indexes independent of kernel addresses KEYCTLREAD returns the serial numbers in a keyring in associative-array traversal order. The first word of the index is a public, deterministic hash of the type pointer,...

CVE-2026-99221 keys/trusted_keys: return immediately after TPM unseal failure

In the Linux kernel, the following vulnerability has been resolved: keys/trustedkeys: return immediately after TPM unseal failure trustedtpmunseal proceeds to pcrlock when the TPM unseal operation fails. If pcrlock succeeds, its return value overwrites the unseal error, causing key instantiation ...

CVE-2026-99221

The Linux kernel contains a vulnerability in the keys/trusted_keys component. Specifically, the trusted_tpm_unseal() function incorrectly proceeds to call pcrlock() even if a TPM unseal operation fails. If pcrlock() succeeds, its return value overwrites the original unseal error, leading to succe...

CVE-2026-99221 keys/trusted_keys: return immediately after TPM unseal failure

In the Linux kernel, the following vulnerability has been resolved: keys/trustedkeys: return immediately after TPM unseal failure trustedtpmunseal proceeds to pcrlock when the TPM unseal operation fails. If pcrlock succeeds, its return value overwrites the unseal error, causing key instantiation ...

CVE-2026-99222 keys: Protect the read method check against type removal

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal keyctlreadkey checks key-type-read without holding key-sem. A reference keeps the key alive, but does not pin the module containing its type. A surviving RxRPC key can...

CVE-2026-99222 keys: Protect the read method check against type removal

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal keyctlreadkey checks key-type-read without holding key-sem. A reference keeps the key alive, but does not pin the module containing its type. A surviving RxRPC key can...

EUVD-2026-115263

In the Linux kernel, the following vulnerability has been resolved: keys/trustedkeys: return immediately after TPM unseal failure trustedtpmunseal proceeds to pcrlock when the TPM unseal operation fails. If pcrlock succeeds, its return value overwrites the unseal error, causing key instantiation ...

CVE-2026-99222

The Linux kernel contains a vulnerability in the key management system where keyctl_read_key() performs a method check on key->type->read without holding the key->sem semaphore. This allows a race condition where a surviving RxRPC key can be read while the AF_RXRPC module is being unload...

EUVD-2026-115264

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal keyctlreadkey checks key-type-read without holding key-sem. A reference keeps the key alive, but does not pin the module containing its type. A surviving RxRPC key can...

EUVD-2026-115262

In the Linux kernel, the following vulnerability has been resolved: asymmetrickeys: reject trust keys without IDs The PKCS8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon unconditionally dereferences that slot when a PKCS8 key is supplied to a keyorkeyring...