Skip to main content
No exploitation reportedAwaiting NVD analysis

CVE-2026-99224

keys: Protect the type name while describing a key

No exploitation reported by the sources we read.

  • Published2026-11-02

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the type name while describing a key keyctl_describe_key() must keep the key type's name alive until kasprintf() has consumed it. The retained key reference keeps the key and its description alive, but does not pin the module providing its type. The name is passed to kasprintf() without holding key->sem. kvasprintf() uses the saved name pointer in two formatting passes, with a GFP_KERNEL allocation between them. With AF_RXRPC=m, a task that passes View permission before type retirement can overlap a privileged module unload in this order: 1. KEYCTL_DESCRIBE looks up the key, saves key->type->name in the kasprintf() arguments and completes the first formatting pass. 2. While the formatter is delayed before its second pass, af_rxrpc_exit() calls unregister_key_type(), which removes the type from the registry and waits for key_gc_keytype(). 3. The collector takes key->sem for writing, retypes the retained key to key_type_dead and completes retirement. Unregistration and module exit return, allowing free_module() to release the type and name. 4. The formatter resumes its second pass and reads the saved name from released module storage, which can fault in string(). Hold key->sem for reading across kasprintf(). The collector then cannot retype the key or complete retirement until both formatting passes have finished. If retirement wins the lock first, formatting uses the core key_type_dead name instead. Release the semaphore immediately after kasprintf(), including on allocation failure, before copying to userspace. Oops report as below: BUG: unable to handle page fault for address: fffffbfff8054794 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page RIP: 0010:string+0x23f/0x470 Call Trace: vsnprintf+0x330/0x1110

Timeline

dates in UTC
  1. 2026-11-0216:06CVE publishedCNA

Observed activity

isMalicious corpus · updated 2026-11-02 15:37 UTC
Indicators tagged with this CVE, per day0 indicators over 7 days
Block these indicators
  • Firewall list (EDL, text): https://api.ismalicious.com/edl/cve/CVE-2026-99224?format=txt
  • CSV export: https://api.ismalicious.com/edl/cve/CVE-2026-99224?format=csv
  • TAXII collection of exploited CVEs
  • The EDL and CSV take an API key on the Pro plan.

Versions per branch

Products declared by the CNA

As Linux, the CNA that assigned this CVE, declared them in the CVE record; versions as written. NVD lists no product for this CVE yet: this is the only product data so far.

  • Linuxother versions: not affected

    https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

    Affected
    • ≥ aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7, < 19c4de819e52b7f606468fbfe4fcef4e812e2777fixed in 19c4de819e52b7f606468fbfe4fcef4e812e2777git
    • ≥ aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7, < a49e6c9a1a5b3457c946a8efb616ce13b4ca8194fixed in a49e6c9a1a5b3457c946a8efb616ce13b4ca8194git
    • ≥ aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7, < 916667df7695366f23cfaf365b5840b228cc4b2efixed in 916667df7695366f23cfaf365b5840b228cc4b2egit
    • ≥ aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7, < dddd3a1ab7d12ee163477918ff6eb943361db4fefixed in dddd3a1ab7d12ee163477918ff6eb943361db4fegit
    • ≥ aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7, < 3c3cfd9e262afc9558c38f8cec57f09d10988546fixed in 3c3cfd9e262afc9558c38f8cec57f09d10988546git
    • ≥ aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7, < 6b613747f7ea309ada5b8d05b55398c338f7a968fixed in 6b613747f7ea309ada5b8d05b55398c338f7a968git
    • ≥ aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7, < dea367df18e3a4faac393e3a4e818ee03af89b19fixed in dea367df18e3a4faac393e3a4e818ee03af89b19git
    • ≥ aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7, < 0461bc8f91116aae4a020e15f4e1c1fd535ab35efixed in 0461bc8f91116aae4a020e15f4e1c1fd535ab35egit
  • Linuxother versions: affected

    https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

    Affected
    • = 3.18no fix stated

    Not affected < 3.18 · ≥ 5.10.273, ≤ 5.10.* · ≥ 5.15.224, ≤ 5.15.* · ≥ 6.1.191, ≤ 6.1.* · ≥ 6.6.161, ≤ 6.6.* · ≥ 6.12.115, ≤ 6.12.* · ≥ 6.18.60, ≤ 6.18.*

    2 more version lines in the CVE record.

Source: the CNA record (CVE Program), © The MITRE Corporation,CVE Terms of UseCVE recordupdated 2026-11-02

Neither OSV.dev nor the vendor advisories we read list affected versions for CVE-2026-99224 yet.

Full record on NVD

Fix

No fix published by the sources we read yet. NVD record

Detection

Nuclei template
none so far
ProjectDiscovery
Exploit-DB
no entry
Exploit-DB
Proof-of-concept repositories
none listed
PoC-in-GitHub
Metasploit modules
none listed
Metasploit Framework

Sources

  • NVDCVE recordread 2026-11-02
  • CNACVSS 3.172026-11-02

Identifiers

Technical details

CVSS v3 Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
2026-11-02
Last Modified
2026-11-02
NVD status
Received

Frequently asked questions

What is CVE-2026-99224?

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the type name while describing a key keyctl_describe_key() must keep the key type's name alive until kasprintf() has consumed it. The retained key reference keeps the key and its description alive, but does not pin the module providing its type. The name is passed to kasprintf() without holding key->sem. kvasprintf() uses the saved name pointer in two formatting passes, with a GFP_KERNEL allocation between them. With AF_RXRPC=m, a task that passes View permission before type retirement can overlap a privileged module unload in this order: 1. KEYCTL_DESCRIBE looks up the key, saves key->type->name in the kasprintf() arguments and completes the first formatting pass. 2. While the formatter is delayed before its second pass, af_rxrpc_exit() calls unregister_key_type(), which removes the type from the registry and waits for key_gc_keytype(). 3. The collector takes key->sem for writing, retypes the retained key to key_type_dead and completes retirement. Unregistration and module exit return, allowing free_module() to release the type and name. 4. The formatter resumes its second pass and reads the saved name from released module storage, which can fault in string(). Hold key->sem for reading across kasprintf(). The collector then cannot retype the key or complete retirement until both formatting passes have finished. If retirement wins the lock first, formatting uses the core key_type_dead name instead. Release the semaphore immediately after kasprintf(), including on allocation failure, before copying to userspace. Oops report as below: BUG: unable to handle page fault for address: fffffbfff8054794 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page RIP: 0010:string+0x23f/0x470 Call Trace: vsnprintf+0x330/0x1110

Is CVE-2026-99224 actively exploited?

Active exploitation of CVE-2026-99224 has not been confirmed.

What is the CVSS score for CVE-2026-99224?

CVE-2026-99224 has a CVSS v3 base score of 7 (HIGH severity), with vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Running Linux kernel? Hear about its next vulnerability

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, October 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record