Cloudanix VulnDB

CVE-2026-99224

High · 7.0

CVSS

7.0

EPSS

0.1%

Published

Nov 2, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A timing flaw in the Linux kernel's handling of security keys can make the system crash when certain internal operations overlap.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Full Compromise
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in keyctl_describe_key() permits a key type name pointer from a loadable module to be dereferenced after unregister_key_type() and module unload, causing a use-after-free read during the second pass of kvasprintf().

Why it matters to the business

Local users on Linux systems can trigger kernel crashes or instability, especially in environments relying on modular key types such as AF_RXRPC, increasing operational risk and potential downtime.

How an attack unfolds

An attacker with local access and View permission on a key triggers KEYCTL_DESCRIBE concurrently with a privileged module unload path; the first formatting pass saves the name pointer, the module exits and frees the name storage, and the second pass then reads from released memory, faulting in string().

How to fix it

Apply the upstream fix that acquires key->sem for reading across the entire kasprintf() call and falls back to key_type_dead if retirement occurs first; rebuild and deploy the patched kernel.

How to confirm the fix worked

Inspect the keyctl_describe_key() implementation to confirm key->sem is held for read during both formatting passes of kasprintf() and released before userspace copy.

Typical attack path

  1. Obtain local unprivileged access to a Linux system using modular key types
  2. Acquire View permission on a retained key whose type can be unregistered
  3. Trigger keyctl_describe_key() to begin kasprintf() formatting
  4. Cause concurrent type retirement and module unload via af_rxrpc_exit or equivalent
  5. Force the second formatting pass to dereference the now-freed name pointer

How to detect it

Search kernel logs and crash dumps for page faults in string() or vsnprintf immediately following keyctl_describe_key activity or module unloads involving key types; correlate with key_gc_keytype traces.

  • BUG: unable to handle page fault for address
  • RIP: string+0x23f/0x470
  • keyctl_describe_key
  • af_rxrpc_exit

What your security team should do

  • Prioritize kernel updates containing the semaphore fix within the next maintenance window
  • Limit local user access and keyctl permissions where operationally feasible
  • Monitor kernel oops logs for page faults originating in string() or vsnprintf during key operations

The record

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the type name while describing a key keyctl_describe_key() must keep the key type's name alive until kasprintf() has consumed it. The retained key reference keeps the key and its description alive, but does not pin the module providing its type. The name is passed to kasprintf() without holding key->sem. kvasprintf() uses the saved name pointer in two formatting passes, with a GFP_KERNEL allocation between them. With AF_RXRPC=m, a task that passes View permission before type retirement can overlap a privileged module unload in this order: 1. KEYCTL_DESCRIBE looks up the key, saves key->type->name in the kasprintf() arguments and completes the first formatting pass. 2. While the formatter is delayed before its second pass, af_rxrpc_exit() calls unregister_key_type(), which removes the type from the registry and waits for key_gc_keytype(). 3. The collector takes key->sem for writing, retypes the retained key to key_type_dead and completes retirement. Unregistration and module exit return, allowing free_module() to release the type and name. 4. The formatter resumes its second pass and reads the saved name from released module storage, which can fault in string(). Hold key->sem for reading across kasprintf(). The collector then cannot retype the key or complete retirement until both formatting passes have finished. If retirement wins the lock first, formatting uses the core key_type_dead name instead. Release the semaphore immediately after kasprintf(), including on allocation failure, before copying to userspace. Oops report as below: BUG: unable to handle page fault for address: fffffbfff8054794 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page RIP: 0010:string+0x23f/0x470 Call Trace: vsnprintf+0x330/0x1110

Affected packages

Ecosystem Package Introduced Fixed