CVE-2026-93106

A flaw was found in the Linux kernel's crash_dump functionality, specifically in how it handles dm-crypt keys. When multiple dm-crypt keys are restored, a reference to the user keyring is incorrectly dropped multiple times. This can lead to a reference count underflow or a use-after-free condition, potentially causing system instability or a denial of service.

A reference counting bug in crash_dump dm-crypt key restore can drop the same keyring_ref once for every restored key. With multiple saved keys, add_key_to_keyring() may over release the user keyring reference and trigger refcount underflow or use-after-free during restore. For the CVSS the PR:H is used because reliable triggering normally requires administrative control of kdump or crash dump dm-crypt key restore configuration on the target system. The issue is local and is not network reachable. Impact is at least denial of service through a warning, crash, or corrupted keyring lifetime state.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.