CVE-2026-64015

A flaw was found in the Linux kernel's keyring code. The assoc_array_find() function, used for looking up keys, was called without holding the necessary Read-Copy-Update (RCU) read lock. This oversight allows for a memory corruption vulnerability, particularly affecting persistent key handling, as the system's garbage collection mechanism can free memory while it is still in use. This could lead to a denial of service.

This vulnerability is evaluated as a Moderate severity issue because exploitation requires an authenticated local user and winning a narrow race condition against kernel memory reclamation. While standard Red Hat Enterprise Linux installations enable kernel keyring functionality by default, triggering the underlying memory corruption necessitates concurrent persistent key lookups and garbage collection. Consequently, the flaw primarily poses a local denial of service or privilege escalation risk under specific operational concurrency.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.