{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-99224","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-25T10:25:14.402Z","datePublished":"2026-11-02T16:06:34.014Z","dateUpdated":"2026-11-03T19:12:57.782Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-11-03T19:12:57.782Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the type name while describing a key\n\nkeyctl_describe_key() must keep the key type's name alive until\nkasprintf() has consumed it. The retained key reference keeps the key\nand its description alive, but does not pin the module providing its\ntype. The name is passed to kasprintf() without holding key->sem.\n\nkvasprintf() uses the saved name pointer in two formatting passes, with\na GFP_KERNEL allocation between them. With AF_RXRPC=m, a task that\npasses View permission before type retirement can overlap a privileged\nmodule unload in this order:\n\n1. KEYCTL_DESCRIBE looks up the key, saves key->type->name in the\n   kasprintf() arguments and completes the first formatting pass.\n2. While the formatter is delayed before its second pass,\n   af_rxrpc_exit() calls unregister_key_type(), which removes the type\n   from the registry and waits for key_gc_keytype().\n3. The collector takes key->sem for writing, retypes the retained key\n   to key_type_dead and completes retirement. Unregistration and module\n   exit return, allowing free_module() to release the type and name.\n4. The formatter resumes its second pass and reads the saved name from\n   released module storage, which can fault in string().\n\nHold key->sem for reading across kasprintf(). The collector then cannot\nretype the key or complete retirement until both formatting passes have\nfinished. If retirement wins the lock first, formatting uses the core\nkey_type_dead name instead. Release the semaphore immediately after\nkasprintf(), including on allocation failure, before copying to\nuserspace.\n\nOops report as below:\n\n    BUG: unable to handle page fault for address: fffffbfff8054794\n    #PF: supervisor read access in kernel mode\n    #PF: error_code(0x0000) - not-present page\n    RIP: 0010:string+0x23f/0x470\n    Call Trace:\n     vsnprintf+0x330/0x1110"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Reached from SYSCALL_DEFINE5(keyctl) case KEYCTL_DESCRIBE → keyctl_describe_key(), which passes the in-kernel key->type->name pointer into kasprintf(). The attacker supplies only a key serial via that local syscall; no network protocol carries the type name.\nAC:H - The UAF fires only if unregister_key_type() → key_gc_keytype() (e.g. af_rxrpc_exit) retypes the key and free_module() unmaps the name after keyctl_describe_key() captures key->type->name and before kvasprintf()'s second vsnprintf. delete_module() requires capable(CAP_SYS_MODULE), which this caller cannot get, including in a user namespace.\nPR:L - keyctl_describe_key() uses lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, KEY_NEED_VIEW) with no capable() check. An unprivileged user can add_key(\"rxrpc\", …) with an empty payload (rxrpc_preparse allows datalen==0) into their session keyring and describe it via the default KEY_POS_VIEW|KEY_USR_VIEW bits.\nUI:N - The attacker calls KEYCTL_DESCRIBE on a key they already own. The overlapping admin rmmod/delete_module of the type's module is the AC:H condition, not a victim mount or open of attacker content.\nS:U - The dangling key->type->name read in kvasprintf()/string() and any resulting oops stay inside the host kernel's keyctl path; this does not cross a VM, IOMMU, or sandbox boundary.\nC:H - keyctl_describe_key() copy_to_user()s the kasprintf() buffer that embeds the dangling key->type->name. kvasprintf() walks that pointer in two vsnprintf/string() passes, so after free_module() of af_rxrpc the describe buffer can contain remapped freed module memory, including a large copy if the first pass also races.\nI:H - After key_gc_keytype() retypes the key and free_module() releases af_rxrpc, the captured name pointer aliases freed module pages. Reclaim of those pages lets the attacker control the %s bytes kasprintf() later formats, turning this use-after-free into a kernel write/control-flow primitive per UAF scoring guidance.\nA:H - The reported oops is a supervisor not-present-page fault in string() from vsnprintf() once free_module() has unmapped the type name, which is a kernel oops."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/keys/keyctl.c"],"versions":[{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"19c4de819e52b7f606468fbfe4fcef4e812e2777","status":"affected","versionType":"git"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"a49e6c9a1a5b3457c946a8efb616ce13b4ca8194","status":"affected","versionType":"git"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"916667df7695366f23cfaf365b5840b228cc4b2e","status":"affected","versionType":"git"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"dddd3a1ab7d12ee163477918ff6eb943361db4fe","status":"affected","versionType":"git"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"3c3cfd9e262afc9558c38f8cec57f09d10988546","status":"affected","versionType":"git"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"6b613747f7ea309ada5b8d05b55398c338f7a968","status":"affected","versionType":"git"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"dea367df18e3a4faac393e3a4e818ee03af89b19","status":"affected","versionType":"git"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"0461bc8f91116aae4a020e15f4e1c1fd535ab35e","status":"affected","versionType":"git"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"fced7238b7e80cf8aa688d5af976e4aa6e33c329","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/keys/keyctl.c"],"versions":[{"version":"3.18","status":"affected"},{"version":"0","lessThan":"3.18","status":"unaffected","versionType":"semver"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","status":"unaffected","versionType":"semver"},{"version":"7.4-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18","versionEndExcluding":"6.6.161"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18","versionEndExcluding":"6.12.115"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18","versionEndExcluding":"6.18.60"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18","versionEndExcluding":"7.2.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18","versionEndExcluding":"7.3.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18","versionEndExcluding":"7.4-rc1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/19c4de819e52b7f606468fbfe4fcef4e812e2777"},{"url":"https://git.kernel.org/stable/c/a49e6c9a1a5b3457c946a8efb616ce13b4ca8194"},{"url":"https://git.kernel.org/stable/c/916667df7695366f23cfaf365b5840b228cc4b2e"},{"url":"https://git.kernel.org/stable/c/dddd3a1ab7d12ee163477918ff6eb943361db4fe"},{"url":"https://git.kernel.org/stable/c/3c3cfd9e262afc9558c38f8cec57f09d10988546"},{"url":"https://git.kernel.org/stable/c/6b613747f7ea309ada5b8d05b55398c338f7a968"},{"url":"https://git.kernel.org/stable/c/dea367df18e3a4faac393e3a4e818ee03af89b19"},{"url":"https://git.kernel.org/stable/c/0461bc8f91116aae4a020e15f4e1c1fd535ab35e"},{"url":"https://git.kernel.org/stable/c/fced7238b7e80cf8aa688d5af976e4aa6e33c329"}],"title":"keys: Protect the type name while describing a key","x_generator":{"engine":"bippy-1.2.0"}}}}