CVE-2026-74566

A flaw was found in the Linux kernel's keys subsystem. An inconsistency in how key descriptions are processed by the keyring_get_key_chunk() and keyring_diff_objects() functions could allow a local attacker to create specially crafted key descriptions. These crafted descriptions might collide, potentially leading to unexpected system behavior or a denial of service.

The keyring index can place crafted key descriptions incorrectly because keyring_get_key_chunk() and keyring_diff_objects() disagree on byte order and bit position. This may allow two distinct key descriptions to collide in the in-memory keyring lookup structure, which can cause key lookup confusion, shadowing, or failure to retrieve the intended key. For the CVSS the PR:L is used for the paranoid score because a local unprivileged process can normally create keys and crafted descriptions through keyctl or add_key, while reliable impact against another keyring still depends on keyring permissions. The issue is not directly network reachable and requires local interaction with the kernel key management API. Impact is primarily integrity and availability risk in key lookup behavior, with limited confidentiality impact possible in sensitive key management scenarios. It is not classified as proven memory corruption or direct privilege escalation from the patch alone.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.