{"id":"CVE-2026-99040","revision":"2089131c6f59414eb05eec8e73cf0ca1","records":[{"revision":"2089131c6f59414eb05eec8e73cf0ca1","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-99040","aliases":[],"title":"KEYS: Fix add_key() race with keyring restriction","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: Fix add_key() race with keyring restriction\n\n__key_create_or_update() snapshots keyring->restrict_link before taking\nthe destination keyring's semaphore.  keyring_restrict() installs a\nrestriction while holding that semaphore.\n\nThis allows a writer to observe no restriction, wait for the keyring\nowner to install a reject-all restriction and return successfully, and\nthen link a key using the stale NULL snapshot.  The writer only needs\nwrite permission on the destination keyring.\n\nMove the restrict_link read after __key_link_lock() and\n__key_link_begin().  The read and the subsequent restriction check are\nthen serialized with restriction installation by keyring->sem.\n\nThe race was reproduced on v7.2.8 in 19 executions where restriction\ninstallation returned before the link completed.  All 19 linked the key\ndespite the reject-all restriction.  With this change, 312 executions\nreached the same ordering and every add_key() call failed with -EPERM.\n\nThe issue was found by manual concurrency analysis assisted by AI-based\nanalysis and independently verified with a QEMU reproducer and kernel\ninstrumentation.","state":0,"publishedAt":"2026-10-23T12:21:59.288+00:00","modifiedAt":"2026-10-23T12:21:59.288+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"security/keys/key.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c\",\n                            \"lessThan\": \"305f1828b871dd46bf41addeb6f11d2c162dcb25\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c\",\n                            \"lessThan\": \"f99399b48e3edd6851fac34cd329bab9f1f33baf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c\",\n                            \"lessThan\": \"11516a0c402a6c1fa52254aa70d8d65fb921e59e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c\",\n                            \"lessThan\": \"da0b595d8e6e2dd798f6e34e09dc51a13b888514\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c\",\n                            \"lessThan\": \"dd3ea3fcba7c75493760cdbccd35f029597e8d5e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"security/keys/key.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.113\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.11\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/305f1828b871dd46bf41addeb6f11d2c162dcb25","https://git.kernel.org/stable/c/f99399b48e3edd6851fac34cd329bab9f1f33baf","https://git.kernel.org/stable/c/11516a0c402a6c1fa52254aa70d8d65fb921e59e","https://git.kernel.org/stable/c/da0b595d8e6e2dd798f6e34e09dc51a13b888514","https://git.kernel.org/stable/c/dd3ea3fcba7c75493760cdbccd35f029597e8d5e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99040","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99040","identifiers":["CVE-2026-99040"]},"retained":false,"historicalAffected":[]}],"coverage":[]}