CVE-2026-99226

A flaw was found in the Linux kernel's keyrings subsystem. A race condition between concurrent named keyring lookups and key ownership changes allows a local user to cause a use-after-free read. When a key's ownership is transferred while a lookup is in progress, the previous user structure can be freed before its identifier is read, potentially leading to a system crash and Denial of Service (DoS).

This vulnerability is rated as having a Moderate impact because it requires local system access and precise timing to trigger a race condition during concurrent key management operations. An unprivileged local user must perform a named session join while a concurrent privileged operation modifies key ownership on another processor, making the race window narrow and difficult to hit reliably. The blast radius is confined to a local denial of service via a kernel panic, with no direct threat to system confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.