Linux Kernel Key Management Vulnerability Affecting Key Types

CVE-2026-99224

What is CVE-2026-99224?

A key management vulnerability in the Linux kernel can lead to system instability through improper handling of key type names during key description processes. Specifically, the keyctl_describe_key() function fails to keep the key type's name reference secure while formatting, resulting in the potential for a privileged module to be unloaded while it is still being accessed. This creates risks where tasks may reference nonexistent modules, resulting in kernel memory faults. It is vital to ensure that key references are protected appropriately during the key description process to prevent this type of fault and maintain kernel stability.

References