CVE-2015-7872

What it actually does

The flaw in key_gc_unused_keys allows crafted keyctl commands to trigger a kernel oops by mishandling unused keys during garbage collection.

Why it matters to the business

Local users can crash affected Linux systems, causing unplanned downtime, service interruptions, and potential loss of in-memory data on servers and endpoints.

How an attack unfolds

An attacker with local shell access issues specially crafted keyctl system calls that reach the vulnerable garbage-collection path, forcing an oops and immediate denial of service.

How to fix it

Upgrade the Linux kernel to a version newer than 4.2.6 that contains the fix for the key_gc_unused_keys oops; apply vendor-supplied kernel updates as soon as they are available.

How to confirm the fix worked

Confirm the running kernel version exceeds 4.2.6, then attempt the previously crashing keyctl sequence in a test environment to verify the oops no longer occurs.

Typical attack path

1. Gain local interactive access to a vulnerable Linux host
2. Prepare and execute crafted keyctl commands targeting the key garbage collector
3. Trigger kernel oops resulting in denial of service

How to detect it

Review kernel logs for oops entries referencing key_gc_unused_keys or security/keys/gc.c; correlate with unusual keyctl invocations from local processes.

• key_gc_unused_keys
• security/keys/gc.c
• keyctl.*OOPS

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-user Linux systems
• Limit local user accounts and capabilities via SELinux or AppArmor where full patching is delayed
• Include keyctl-related oops signatures in kernel log monitoring