CVE-2026-93106

What it actually does

Incorrect keyring reference management in restore_dm_crypt_keys_to_thread_keyring() causes the reference obtained via lookup_user_key() to be dropped once per key by add_key_to_keyring() and also leaked on early error paths, producing refcount underflow or use-after-free when more than one dm-crypt key is restored.

Why it matters to the business

Kernel memory corruption can occur on systems that restore multiple dm-crypt keys during crash-dump processing, potentially leading to crashes, data loss, or local privilege escalation; the issue affects Linux distributions handling encrypted volumes and has been public for over a month.

How an attack unfolds

An attacker with the ability to trigger dm-crypt key restoration (for example via a crafted crash-dump or keyring manipulation) supplies more than one saved key; each call to add_key_to_keyring() consumes the shared reference, driving the refcount negative and creating a window for use-after-free exploitation or kernel panic.

How to fix it

Update to a Linux kernel containing the referenced fix that keeps ownership of the keyring reference inside restore_dm_crypt_keys_to_thread_keyring() and drops it exactly once on every exit path; apply the vendor-supplied kernel package as soon as it becomes available.

How to confirm the fix worked

Confirm the installed kernel version contains the patch that removes the extra reference drops from add_key_to_keyring() and ensures a single put on all return paths; review kernel source or changelog for the commit titled 'crash_dump: release keyring reference at the correct time'.

Typical attack path

1. Obtain ability to trigger restore_dm_crypt_keys_to_thread_keyring() with multiple saved keys
2. Cause the function to call add_key_to_keyring() repeatedly on the same keyring reference
3. Trigger refcount underflow or subsequent use of the freed keyring object
4. Leverage the resulting memory corruption for privilege escalation or denial of service

How to detect it

Examine kernel logs for refcount underflow or use-after-free warnings mentioning keyring or restore_dm_crypt_keys_to_thread_keyring(); correlate with crash-dump activity or dm-crypt key operations; no widely published exploit artifacts are known.

What your security team should do

• Prioritize kernel updates on systems that use dm-crypt or perform crash-dump key restoration
• Monitor upstream kernel changelogs and distribution security advisories for the fix
• Limit untrusted local access on systems where the vulnerable code path can be reached