CVE-2025-21893

In the Linux kernel, the following vulnerability has been resolved:

keys: Fix UAF in key_put()

Once a key's reference count has been reduced to 0, the garbage collector thread may destroy it at any time and so key_put() is not allowed to touch the key after that point. The most key_put() is normally allowed to do is to touch key_gc_work as that's a static global variable.

However, in an effort to speed up the reclamation of quota, this is now done in key_put() once the key's usage is reduced to 0 - but now the code is looking at the key after the deadline, which is forbidden.

Fix this by using a flag to indicate that a key can be gc'd now rather than looking at the key's refcount in the garbage collector.

This vulnerability is rated as Moderate because triggering the race condition within the kernel key management subsystem requires local authenticated access. A successful exploit could cause a system crash or result in kernel memory disclosure, but it cannot be executed remotely. Furthermore, earlier platforms such as Red Hat Enterprise Linux 8 and 9 are unaffected as they do not incorporate the vulnerable quota reclamation logic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.