In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix add_key() race with keyring restriction __key_create_or_update()… (CVE-2026-99040)

The vulnerability in the Linux kernel involved a race condition in the add_key() function related to keyring restrictions. Specifically, __key_create_or_update() took a snapshot of keyring->restrict_link before acquiring the destination keyring's semaphore, while keyring_restrict() installed restrictions while holding that semaphore. This allowed a writer to observe no restriction, then wait for the owner to install a reject-all restriction, and still link a key using the stale NULL snapshot. The fix moved the restrict_link read to occur after __key_link_lock() and __key_link_begin(), ensuring serialization with restriction installation via the keyring semaphore. The race was reproducibly demonstrated on version 7.2.8 with 19 successful exploit attempts, all prevented after the fix.

An attacker with write permission on a destination keyring could bypass keyring restrictions and link unauthorized keys despite reject-all restrictions. This could undermine the security controls intended to restrict key usage and potentially lead to privilege escalation or unauthorized access within the kernel's key management system.

The vulnerability has been resolved in the Linux kernel by reordering operations to ensure proper synchronization of keyring restrictions and key linking. Users should update to a Linux kernel version that includes this fix. Patch status is not explicitly stated; check the vendor advisory or kernel changelogs for the specific fixed version and apply updates accordingly.