{"id":"CVE-2026-64015","state":"PUBLISHED","title":"security/keys: fix missed RCU read section on lookup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsecurity/keys: fix missed RCU read section on lookup\n\nNicholas Carlini reports that the keyring code calls assoc_array_find()\nin find_key_to_update() without holding the RCU read lock, while the\nassoc_array_gc() code really is designed around removing the node from\nthe tree and then freeing it after an RCU grace-period.\n\nThe regular key handling doesn't see this because holding the keyring\nsemaphore hides any lifetime issues, but the persistent key handling\nuses a different model.\n\nInstead of extending the keyring locking, just do the simple RCU locking\nthat the assoc_array was designed for.","publishedAt":"2026-07-19T15:39:10.557Z","updatedAt":"2026-10-30T12:27:27.767Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","status":"affected","lessThan":"1d8d987a2aacde238ecd0f4946f28cef74c42b79","versionType":"git"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","status":"affected","lessThan":"5036a9aa7f21fbce89a2a8451bbc177bae2e920d","versionType":"git"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","status":"affected","lessThan":"4c5d407ba3ff7f30561ff73ba1b07ed70c864edc","versionType":"git"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","status":"affected","lessThan":"cefa4265b11176c897a7d9e8e54d89e3701c5584","versionType":"git"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","status":"affected","lessThan":"5659e6923cb72f8e18e8b539109ab512455fe195","versionType":"git"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","status":"affected","lessThan":"50bb3435a5e627bfbdc52eb4536f49f88b3486b8","versionType":"git"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","status":"affected","lessThan":"66288dcadf80974436250e9f70ed848836b835b5","versionType":"git"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","status":"affected","lessThan":"43a1e3744548e6fd85873e6fb43e293eb4010694","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/keys/keyring.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.13","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.142","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.92","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.34","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.11","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/keys/keyring.c"]}],"references":["https://git.kernel.org/stable/c/1d8d987a2aacde238ecd0f4946f28cef74c42b79","https://git.kernel.org/stable/c/5036a9aa7f21fbce89a2a8451bbc177bae2e920d","https://git.kernel.org/stable/c/4c5d407ba3ff7f30561ff73ba1b07ed70c864edc","https://git.kernel.org/stable/c/cefa4265b11176c897a7d9e8e54d89e3701c5584","https://git.kernel.org/stable/c/5659e6923cb72f8e18e8b539109ab512455fe195","https://git.kernel.org/stable/c/50bb3435a5e627bfbdc52eb4536f49f88b3486b8","https://git.kernel.org/stable/c/66288dcadf80974436250e9f70ed848836b835b5","https://git.kernel.org/stable/c/43a1e3744548e6fd85873e6fb43e293eb4010694"],"weaknesses":["CWE-362"],"ingestedAt":"2026-10-30T12:46:06.359Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64015.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64015","state":"PUBLISHED","datePublished":"2026-07-19T15:39:10.557Z","dateUpdated":"2026-10-30T12:27:27.767Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T07:54:57.027Z"},"containers":{"cna":{"title":"security/keys: fix missed RCU read section on lookup","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsecurity/keys: fix missed RCU read section on lookup\n\nNicholas Carlini reports that the keyring code calls assoc_array_find()\nin find_key_to_update() without holding the RCU read lock, while the\nassoc_array_gc() code really is designed around removing the node from\nthe tree and then freeing it after an RCU grace-period.\n\nThe regular key handling doesn't see this because holding the keyring\nsemaphore hides any lifetime issues, but the persistent key handling\nuses a different model.\n\nInstead of extending the keyring locking, just do the simple RCU locking\nthat the assoc_array was designed for."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","status":"affected","lessThan":"1d8d987a2aacde238ecd0f4946f28cef74c42b79","versionType":"git"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","status":"affected","lessThan":"5036a9aa7f21fbce89a2a8451bbc177bae2e920d","versionType":"git"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","status":"affected","lessThan":"4c5d407ba3ff7f30561ff73ba1b07ed70c864edc","versionType":"git"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","status":"affected","lessThan":"cefa4265b11176c897a7d9e8e54d89e3701c5584","versionType":"git"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","status":"affected","lessThan":"5659e6923cb72f8e18e8b539109ab512455fe195","versionType":"git"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","status":"affected","lessThan":"50bb3435a5e627bfbdc52eb4536f49f88b3486b8","versionType":"git"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","status":"affected","lessThan":"66288dcadf80974436250e9f70ed848836b835b5","versionType":"git"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","status":"affected","lessThan":"43a1e3744548e6fd85873e6fb43e293eb4010694","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/keys/keyring.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.13","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.142","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.92","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.34","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.11","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/keys/keyring.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/1d8d987a2aacde238ecd0f4946f28cef74c42b79"},{"url":"https://git.kernel.org/stable/c/5036a9aa7f21fbce89a2a8451bbc177bae2e920d"},{"url":"https://git.kernel.org/stable/c/4c5d407ba3ff7f30561ff73ba1b07ed70c864edc"},{"url":"https://git.kernel.org/stable/c/cefa4265b11176c897a7d9e8e54d89e3701c5584"},{"url":"https://git.kernel.org/stable/c/5659e6923cb72f8e18e8b539109ab512455fe195"},{"url":"https://git.kernel.org/stable/c/50bb3435a5e627bfbdc52eb4536f49f88b3486b8"},{"url":"https://git.kernel.org/stable/c/66288dcadf80974436250e9f70ed848836b835b5"},{"url":"https://git.kernel.org/stable/c/43a1e3744548e6fd85873e6fb43e293eb4010694"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through find_key_to_update() on the persistent keyring register, which is invoked from keyctl_get_persistent() via the keyctl(2) syscall. There is no network, adjacent-radio, or physical-device path to this code.\nAC:L - Exploitation is a race between assoc_array_find() and assoc_array_gc() on the .persistent_register keyring; the attacker controls both sides by repeatedly calling KEYCTL_GET_PERSISTENT (including from multiple threads) while driving key expiry/GC via keyctl timeouts or natural garbage collection. Per kernel guidance, attacker-controlled races are AC:L.\nPR:L - Any unprivileged local user who can invoke keyctl() can call KEYCTL_GET_PERSISTENT for their own UID (-1) with a writable destination keyring (e.g., session keyring). No real-root or CAP_SETUID capability is required for the vulnerable lookup path; this remains PR:L even inside user namespaces.\nUI:N - Exploitation requires only the attacker's own keyctl syscalls and does not depend on any victim user action such as mounting a filesystem or opening a file.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary on its own.\nC:H - assoc_array_find() is documented to require an RCU read lock, but the persistent-keyring path called it without one while assoc_array_gc() frees tree nodes via call_rcu(), yielding a use-after-free on assoc_array nodes/leaves. UAF on kernel heap objects can be turned into arbitrary kernel memory reads.\nI:H - The freed assoc_array nodes can be reallocated and corrupted through concurrent GC versus lookup, providing a standard kernel heap UAF primitive that can be developed into arbitrary write or code-execution primitives.\nA:H - Dereferencing RCU-freed assoc_array tree nodes during lookup can cause kernel oops/panic from invalid pointer access, and UAF exploitation commonly destabilizes or crashes the kernel even when full exploitation is not attempted."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:27:27.767Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"6.6.142"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"6.12.92"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"6.18.34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"7.0.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-64015","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:35:17.736168Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-362","lang":"en","type":"CWE","description":"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T20:28:08.372Z"}}]}}}