CVE-2026-63823

Summary

In the Linux kernel, the following vulnerability has been resolved:

keys: Pin request_key_auth payload in instantiate paths

A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ =========================

create auth key store rka in auth key wait for helper get auth key load rka from auth key copy user payload sleep on #PF

helper completed detach and free rka destroy auth key wake up use rka->target_key USE-AFTER-FREE

Give request_key_auth payloads a refcount. Take a payload reference while authkey->sem stabilizes the payload and revocation state. Hold that reference across the instantiate and reject paths. Drop the auth key owning reference from revoke and destroy.

[jarkko: Replaced the first two paragraphs of text with an actual concurrency scenario.]

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxb5f545c880a2a47947ba2118b2509644ab7a2969 < d8274181b0f28d450b42489723a5ba81042158d7affected
LinuxLinuxb5f545c880a2a47947ba2118b2509644ab7a2969 < 4982bfabce6b33b3c9eddb4fb900fe5568b7cf91affected
LinuxLinuxb5f545c880a2a47947ba2118b2509644ab7a2969 < 708709c65a1832a99b0eef8ae46e343ddaca3d06affected
LinuxLinuxb5f545c880a2a47947ba2118b2509644ab7a2969 < 35ab4db86774d82389e4b9559e26ab7f68d8e395affected
LinuxLinuxb5f545c880a2a47947ba2118b2509644ab7a2969 < f9b68632ac93cc742f2e411021c4dbfe452ea0c2affected
LinuxLinuxb5f545c880a2a47947ba2118b2509644ab7a2969 < 7216ce8cb12fee44e309503955bb83806b106129affected
LinuxLinuxb5f545c880a2a47947ba2118b2509644ab7a2969 < 83c0a1cb296d955d5f4d1f0bd8a769ba8ed8c29faffected
LinuxLinuxb5f545c880a2a47947ba2118b2509644ab7a2969 < fd15b457a86939c38aa12116adabd8ff686c5e51affected
LinuxLinux2.6.16affected
LinuxLinux0 < 2.6.16unaffected
LinuxLinux5.10.260 <= 5.10.*unaffected
LinuxLinux5.15.211 <= 5.15.*unaffected
LinuxLinux6.1.177 <= 6.1.*unaffected
LinuxLinux6.6.144 <= 6.6.*unaffected
LinuxLinux6.12.95 <= 6.12.*unaffected
LinuxLinux6.18.38 <= 6.18.*unaffected
LinuxLinux7.1.3 <= 7.1.*unaffected
LinuxLinux7.2-rc1 <= *unaffected

Weaknesses

References