Back to CVE List

CVE-2026-63823

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved:

keys: Pin request_key_auth payload in instantiate paths

A: request_key() B: KEYCTL_INSTANTIATE_IOV
================ =========================

create auth key
store rka in auth key
wait for helper
get auth key
load rka from auth key
copy user payload
sleep on #PF

helper completed
detach and free rka
destroy auth key
wake up
use rka->target_key
**USE-AFTER-FREE**

Give request_key_auth payloads a refcount. Take a payload reference while
authkey->sem stabilizes the payload and revocation state. Hold that
reference across the instantiate and reject paths. Drop the auth key
owning reference from revoke and destroy.

[jarkko: Replaced the first two paragraphs of text with an actual
concurrency scenario.]

Vulnerability Details

Published Date
Last Modified
Source
NVD
Vendor
Linux
Product
Linux

External References

Discussion (0)

Add Comment

No comments yet. Be the first!