Executive brief
A vulnerability was identified in the Linux kernel's key management system, which handles how the operating system stores and retrieves security credentials. A race condition could allow a local attacker to cause a system crash or potentially execute unauthorized actions by triggering a 'use-after-free' error during key instantiation. This issue primarily affects system stability and the integrity of the kernel's internal security structures.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's key management subsystem within the request_key_auth payload handling. The flaw is rooted in a race condition between request_key() and KEYCTL_INSTANTIATE_IOV. When a helper process completes, the authorization key (rka) can be detached and freed while another thread is still processing the instantiation path (e.g., sleeping during a page fault while copying user payload). Upon waking, the second thread attempts to access the now-freed rka->target_key. The fix introduces proper reference counting for request_key_auth payloads to ensure they remain pinned during the instantiate and reject paths. This is a local vulnerability requiring the ability to manipulate kernel keys.
Affected products
- Linux Linux Kernel v5.10+
Timeline
- 2026-07-19: disclosed
- 2026-07-04: patched
References
- https://git.kernel.org/stable/c/35ab4db86774d82389e4b9559e26ab7f68d8e395
- https://git.kernel.org/stable/c/4982bfabce6b33b3c9eddb4fb900fe5568b7cf91
- https://git.kernel.org/stable/c/708709c65a1832a99b0eef8ae46e343ddaca3d06
- https://git.kernel.org/stable/c/7216ce8cb12fee44e309503955bb83806b106129
- https://git.kernel.org/stable/c/83c0a1cb296d955d5f4d1f0bd8a769ba8ed8c29f
- https://git.kernel.org/stable/c/d8274181b0f28d450b42489723a5ba81042158d7
- https://git.kernel.org/stable/c/f9b68632ac93cc742f2e411021c4dbfe452ea0c2