CVE-2026-99220

A flaw was found in the Linux kernel. A local, unprivileged attacker could exploit this vulnerability to cause a Denial of Service (DoS) by crashing the system. The issue occurs within the asymmetric key management subsystem when applying restrictions using a key that lacks identifiers, such as a PKCS#8 private key. When an operation subsequently attempts to add a key against this restriction, the kernel unconditionally dereferences an empty identifier field, triggering a null-pointer dereference and kernel panic.

This vulnerability is rated as having Moderate severity because an unprivileged local user can trigger an immediate denial of service by causing a system crash, but cannot achieve arbitrary code execution, privilege escalation, or data exfiltration. Default enterprise Linux environments permit unprivileged user access to keyring operations, allowing any authenticated local account to invoke keyring restrictions. However, exploitation requires local system access and is strictly confined to crashing the host without compromising data confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.