VulnerabilityPublished 2 Nov 2026

CVE-2026-99226: Linux kernel · keys: Avoid the owner account dereference in named keyring lookup

Source GCVE Database

Compare

Authoritative record:CVE-2026-99226· High

Not known to be exploited · fixed in c9664f780f861dd9f11f120c7a03ed0993671ebb : patch Linux kernel soon.

Data as of 2 Nov 2026, 19:29 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in c9664f780f861dd9f11f120c7a03ed0993671ebb, b0830a26e2c3008a6e21863126b4a0e68b2761cd, aa03c8fb4334f14d218020f7431debf2b7766865 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 2 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-9pjv-mg4c-3j9m

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 2ea190d0a006ce5218baa6e798512652446a605a, < c9664f780f861dd9f11f120c7a03ed0993671ebb	Fixed in c9664f780f861dd9f11f120c7a03ed0993671ebb
LinuxLinux	Affected ≥ 2ea190d0a006ce5218baa6e798512652446a605a, < b0830a26e2c3008a6e21863126b4a0e68b2761cd	Fixed in b0830a26e2c3008a6e21863126b4a0e68b2761cd
LinuxLinux	Affected ≥ 2ea190d0a006ce5218baa6e798512652446a605a, < aa03c8fb4334f14d218020f7431debf2b7766865	Fixed in aa03c8fb4334f14d218020f7431debf2b7766865
LinuxLinux	Affected ≥ 2ea190d0a006ce5218baa6e798512652446a605a, < 6763329f673d261641c79212abf773af77b2c922	Fixed in 6763329f673d261641c79212abf773af77b2c922
LinuxLinux	Affected ≥ 2ea190d0a006ce5218baa6e798512652446a605a, < 77249d4b1bb5ad43552b7023c4a0978937aa7a56	Fixed in 77249d4b1bb5ad43552b7023c4a0978937aa7a56
LinuxLinux	Affected ≥ 2ea190d0a006ce5218baa6e798512652446a605a, < 40b12b93ae4ab9e22c3d571e9b09fd08afad53f6	Fixed in 40b12b93ae4ab9e22c3d571e9b09fd08afad53f6

AI-suggested

No specific patch links or vendor advisories are provided in the input. If you cannot patch yet, avoid running untrusted code that can trigger keyring ownership changes concurrently.

Description

CVE-2026-99226 is a use-after-free vulnerability in the Linux kernel's key management subsystem. It arises from a race condition during named keyring lookup where the owner account pointer can be dereferenced after being freed. This occurs because the lookup reads the owner UID under a lock that does not protect the lifetime of the key_user structure, allowing concurrent ownership changes to free the old account. The flaw was detected by KASAN and leads to reading freed memory.

Impact

This vulnerability can lead to a use-after-free condition in kernel memory, potentially causing kernel crashes or memory corruption. While no direct exploit in the wild is known, such flaws can be leveraged for privilege escalation or denial of service if exploited.

Summary

The vulnerability in the Linux kernel involves the named keyring lookup function find_keyring_by_name(), which reads the keyring's owner UID under keyring_name_lock. However, this lock does not protect the key_user structure's lifetime. A race condition can occur when a named session-keyring join overlaps with a privileged keyctl_chown_key() operation on another CPU. If the keyring holds the last reference to its old dynamic key_user and ownership transfer succeeds, the old key_user can be freed between the pointer load and UID read, causing a use-after-free. The fix involves using an inline owner UID (keyring->uid) for the namespace mapping check, which is updated on ownership changes and does not depend on the key_user's lifetime, thus preventing the use-after-free.

References

Community reviews

Loading reviews…