Linux Kernel Vulnerability in Asymmetric Key Handling by Trusted Keys

CVE-2026-99220

What is CVE-2026-99220?

A vulnerability exists in the Linux kernel related to asymmetric key handling, where certain trust keys lacking IDs can lead to a NULL pointer dereference. This occurs in the PKCS#8 parser, which improperly leaves the asym_key_ids payload slot empty. When an unprivileged caller interacts with the key_or_keyring restriction, it allows potential exploitation through a sequence of operations that includes KEYCTL_RESTRICT_KEYRING followed by add_key(). This mismanagement can lead to system instability and crashes, resulting in a kernel panic and a fatal exception.

References