CVE-2026-99222

A flaw was found in the Linux kernel's key management subsystem. A local user can cause a Denial of Service (DoS) by triggering a use-after-free condition during key read operations. This issue occurs because the key validation check accesses key type data without holding the proper lock, allowing freed memory to be accessed if the associated kernel module is unloaded concurrently.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access and precise timing under strict prerequisites, limiting the potential consequence to a system denial of service. To trigger the flaw, an authenticated user must race a key read operation against the unregistration and unloading of an associated kernel module, an operation that normally requires administrative privileges. Because standard configurations do not expose module unloading to unprivileged users and successful exploitation cannot compromise system confidentiality or integrity, the overall risk is reduced.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.