Executive brief
A vulnerability in the Linux kernel's certificate handling could allow a local user to crash the system or potentially access sensitive information. The issue occurs when the system processes specially crafted security certificates that contain empty data fields. An attacker with basic access to the system can exploit this by submitting a malicious certificate through standard system interfaces.
Technical details
An out-of-bounds read vulnerability exists in 'crypto/asymmetric_keys/x509_cert_parser.c' within the Linux kernel. The root cause is a logic error where the first byte of an X.509 extension is read before verifying that the extension's length is sufficient. An unprivileged local attacker can trigger this by submitting a specially crafted certificate via the keyrings(7) API. This can lead to a kernel oops (denial of service) or potentially the leakage of kernel memory contents. Patches have been released for multiple stable branches including 6.6.y, 6.12.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux Kernel 6.4 to 6.6.135, 6.7 to 6.12.82, 6.13 to 6.18.23, 6.19 to 6.19.13, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-07: other: Patch authored
- 2026-04-20: disclosed
- 2026-04-20: advisory
References
- https://git.kernel.org/stable/c/206121294b9cf27f0589857f80d64f87e496ffb2
- https://git.kernel.org/stable/c/30ab358fad0c7daa1d282ec48089901b21b36a20
- https://git.kernel.org/stable/c/672b526def1f94c1be8eb11b885b803da0d8c2f1
- https://git.kernel.org/stable/c/7fb4dadc2734f4020d7543d688b8d49c8e569c61
- https://git.kernel.org/stable/c/d702c3408213bb12bd570bb97204d8340d141c51