Use After Free Vulnerability in Linux Kernel Affects Key Management

CVE-2025-21893

Summary

A critical issue has been identified in the Linux kernel related to the key management system. The problem arises in the key_put() function, where improper handling of key reference counts could allow a race condition that potentially leads to a Use After Free scenario. After the reference count of a key is reduced to zero, the corresponding key can be prematurely destroyed by the garbage collection thread, violating the expected behavior of key management. This flaw permits access to a key instance after it has been freed, which could lead to unexpected behavior or security risks. To mitigate this issue, developers have implemented a flag mechanism that safely indicates when a key can be garbage collected, thereby preventing any unauthorized access and enhancing overall system reliability.

References