Executive brief
A vulnerability was identified in the Linux kernel's keyring management system, which handles security tokens and encryption keys. Under specific conditions involving persistent keys, the system could attempt to access memory that has already been freed. This could lead to a system crash or potentially allow an attacker to disrupt security operations.
Technical details
A race condition exists in security/keys/keyring.c where find_key_to_update() calls assoc_array_find() without holding the required RCU read lock. While standard keyring operations are protected by a semaphore, persistent key handling uses a different locking model that leaves the associative array vulnerable to concurrent garbage collection (assoc_array_gc). An attacker could potentially trigger a use-after-free if a node is freed during an RCU grace period while a lookup is in progress. The fix implements proper RCU locking using guard(rcu)() to ensure node lifetime during lookups.
Affected products
- Linux Linux 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11
Timeline
- 2026-05-28: patched: Initial fix by Linus Torvalds
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/43a1e3744548e6fd85873e6fb43e293eb4010694
- https://git.kernel.org/stable/c/4c5d407ba3ff7f30561ff73ba1b07ed70c864edc
- https://git.kernel.org/stable/c/50bb3435a5e627bfbdc52eb4536f49f88b3486b8
- https://git.kernel.org/stable/c/5659e6923cb72f8e18e8b539109ab512455fe195
- https://git.kernel.org/stable/c/66288dcadf80974436250e9f70ed848836b835b5
- https://git.kernel.org/stable/c/cefa4265b11176c897a7d9e8e54d89e3701c5584