Use-After-Free Vulnerability in Linux Kernel Affecting Request Key Authentication

CVE-2026-63823

What is CVE-2026-63823?

A use-after-free vulnerability exists within the Linux kernel's request_key_auth implementation. This issue arises during the instantiation and revocation process of authentication keys, where the function responsible for managing these keys fails to maintain the proper reference count on payloads. If an auth key is destroyed prematurely while still being referenced, it can lead to unintended use of freed memory, potentially allowing an attacker to exploit the situation. This vulnerability highlights the importance of correctly stabilizing the payload and revocation states before freeing resources.

References