Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-64015

security/keys: fix missed RCU read section on lookup

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assoc_array_find() in find_key_to_update() without holding the RCU read lock, while the assoc_array_gc() code really is designed around removing the node from the tree and then freeing it after an RCU grace-period. The regular key handling doesn't see this because holding the keyring semaphore hides any lifetime issues, but the persistent key handling uses a different model. Instead of extending the keyring locking, just do the simple RCU locking that the assoc_array was designed for.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to < 4c5d407ba3ff7f30561ff73ba1b07ed70c864edcaffected
  • b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to < cefa4265b11176c897a7d9e8e54d89e3701c5584affected
  • b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to < 5659e6923cb72f8e18e8b539109ab512455fe195affected
  • b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to < 50bb3435a5e627bfbdc52eb4536f49f88b3486b8affected
  • b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to < 66288dcadf80974436250e9f70ed848836b835b5affected
  • b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to < 43a1e3744548e6fd85873e6fb43e293eb4010694affected

Linux Linux

Default version status: affected

  • 3.13affected
  • 0 to < 3.13unaffected
  • 6.1.175 to ≤ 6.1.*unaffected
  • 6.6.142 to ≤ 6.6.*unaffected
  • 6.12.92 to ≤ 6.12.*unaffected
  • 6.18.34 to ≤ 6.18.*unaffected
  • 7.0.11 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References