CVE-2026-99226 is a use-after-free vulnerability in the Linux kernel's key management subsystem. It arises from a race condition during named keyring lookup where the owner account pointer can be dereferenced after being freed. This occurs because the lookup reads the owner UID under a lock that does not protect the lifetime of the key_user structure, allowing concurrent ownership changes to free the old account. The flaw was detected by KASAN and leads to reading freed memory.