VulnerabilityPublished 2 Nov 2026

CVE-2026-99225: Linux kernel · keys: Check the authorization payload in process keyring searches

Source GCVE Database

Compare

Authoritative record:CVE-2026-99225· High

Not known to be exploited · fixed in b86db7993051d05810601654e886a1e78e1fa495 : patch Linux kernel soon.

Data as of 2 Nov 2026, 19:29 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in b86db7993051d05810601654e886a1e78e1fa495, b4dfda438fee3c6faa15d9b421c373de6a0e476f, 26949c2e4c461e9e620e935bc22717f36a40b615 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 2 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-fm9c-q6vv-f7qq

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ e59428f721ee096d8a020504ea908a6f0d952735, < b86db7993051d05810601654e886a1e78e1fa495	Fixed in b86db7993051d05810601654e886a1e78e1fa495
LinuxLinux	Affected ≥ e59428f721ee096d8a020504ea908a6f0d952735, < b4dfda438fee3c6faa15d9b421c373de6a0e476f	Fixed in b4dfda438fee3c6faa15d9b421c373de6a0e476f
LinuxLinux	Affected ≥ e59428f721ee096d8a020504ea908a6f0d952735, < 26949c2e4c461e9e620e935bc22717f36a40b615	Fixed in 26949c2e4c461e9e620e935bc22717f36a40b615
LinuxLinux	Affected ≥ e59428f721ee096d8a020504ea908a6f0d952735, < 984a178d54515779a1bee100b92a6cee8777c830	Fixed in 984a178d54515779a1bee100b92a6cee8777c830
LinuxLinux	Affected ≥ e59428f721ee096d8a020504ea908a6f0d952735, < 458cf9715af6aff3ac8d2ec60bd59e9d6236fd0f	Fixed in 458cf9715af6aff3ac8d2ec60bd59e9d6236fd0f
LinuxLinux	Affected ≥ e59428f721ee096d8a020504ea908a6f0d952735, < 49f4e768540d25d8852ef750313afda6a4774871	Fixed in 49f4e768540d25d8852ef750313afda6a4774871

AI-suggested

The vulnerability has been resolved in the Linux kernel by changing the payload loading to use dereference_key_rcu() and requiring a non-NULL payload before validation and searching saved credentials. Users should apply the official Linux kernel updates that include this fix. No additional mitigation is indicated.

Description

A vulnerability in the Linux kernel's keyring authorization process can cause a NULL pointer dereference leading to a kernel oops. This occurs when the authorization payload is cleared during a key search, but the code attempts to dereference a now NULL pointer. The flaw arises from improper synchronization between key validation and payload revocation in process keyring searches.

References

Community reviews

Loading reviews…