CVE-2026-99220

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99220", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.401Z", "datePublished": "2026-11-02T16:06:31.966Z", "dateUpdated": "2026-11-03T19:12:54.971Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-03T19:12:54.971Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nasymmetric_keys: reject trust keys without IDs\n\nThe PKCS#8 parser deliberately leaves the asym_key_ids payload slot\nempty. key_or_keyring_common() unconditionally dereferences that slot\nwhen a PKCS#8 key is supplied to a key_or_keyring restriction. Both the\nplain and :chain forms reach this branch, allowing an unprivileged caller\nto trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING\nfollowed by add_key().\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279)\n Call Trace:\n <TASK>\n __key_create_or_update (security/keys/key.c:884)\n key_create_or_update (security/keys/key.c:1021)\n __do_sys_add_key (security/keys/keyctl.c:134)\n do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n </TASK>\n Kernel panic - not syncing: Fatal exception\n\nReject an asymmetric restriction key without key IDs. A PKCS#8 private\nkey cannot identify the signer of a candidate certificate and is not a\nvalid trust anchor."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["crypto/asymmetric_keys/restrict.c"], "versions": [{"version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413", "lessThan": "889a2293a95f6c2880bf73b67f9b0af23251a128", "status": "affected", "versionType": "git"}, {"version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413", "lessThan": "7f0728ba89624e25df2bb80ff59bbfb545060935", "status": "affected", "versionType": "git"}, {"version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413", "lessThan": "2a40bdd4409567de4c2a141ac66439dc238af752", "status": "affected", "versionType": "git"}, {"version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413", "lessThan": "1aa0c7aa4c2554a5b6d74ae1924508ca4718234b", "status": "affected", "versionType": "git"}, {"version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413", "lessThan": "33a078f04e264eb71aa9f209cb334e4010123818", "status": "affected", "versionType": "git"}, {"version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413", "lessThan": "57e54b6939c6539d90a81c7e57531901d5991651", "status": "affected", "versionType": "git"}, {"version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413", "lessThan": "9695df3b1db4ac4534274d38ee16e3b9b0bf910e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["crypto/asymmetric_keys/restrict.c"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.60", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.14", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.1", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.4-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.18.60"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.2.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.3.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.4-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/889a2293a95f6c2880bf73b67f9b0af23251a128"}, {"url": "https://git.kernel.org/stable/c/7f0728ba89624e25df2bb80ff59bbfb545060935"}, {"url": "https://git.kernel.org/stable/c/2a40bdd4409567de4c2a141ac66439dc238af752"}, {"url": "https://git.kernel.org/stable/c/1aa0c7aa4c2554a5b6d74ae1924508ca4718234b"}, {"url": "https://git.kernel.org/stable/c/33a078f04e264eb71aa9f209cb334e4010123818"}, {"url": "https://git.kernel.org/stable/c/57e54b6939c6539d90a81c7e57531901d5991651"}, {"url": "https://git.kernel.org/stable/c/9695df3b1db4ac4534274d38ee16e3b9b0bf910e"}], "title": "asymmetric_keys: reject trust keys without IDs", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["crypto/asymmetric_keys/restrict.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "889a2293a95f6c2880bf73b67f9b0af23251a128", "status": "affected", "version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413", "versionType": "git"}, {"lessThan": "7f0728ba89624e25df2bb80ff59bbfb545060935", "status": "affected", "version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413", "versionType": "git"}, {"lessThan": "2a40bdd4409567de4c2a141ac66439dc238af752", "status": "affected", "version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413", "versionType": "git"}, {"lessThan": "1aa0c7aa4c2554a5b6d74ae1924508ca4718234b", "status": "affected", "version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413", "versionType": "git"}, {"lessThan": "33a078f04e264eb71aa9f209cb334e4010123818", "status": "affected", "version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413", "versionType": "git"}, {"lessThan": "57e54b6939c6539d90a81c7e57531901d5991651", "status": "affected", "version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413", "versionType": "git"}, {"lessThan": "9695df3b1db4ac4534274d38ee16e3b9b0bf910e", "status": "affected", "version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["crypto/asymmetric_keys/restrict.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.60", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.14", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.4-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nasymmetric_keys: reject trust keys without IDs\n\nThe PKCS#8 parser deliberately leaves the asym_key_ids payload slot\nempty. key_or_keyring_common() unconditionally dereferences that slot\nwhen a PKCS#8 key is supplied to a key_or_keyring restriction. Both the\nplain and :chain forms reach this branch, allowing an unprivileged caller\nto trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING\nfollowed by add_key().\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279)\n Call Trace:\n <TASK>\n __key_create_or_update (security/keys/key.c:884)\n key_create_or_update (security/keys/key.c:1021)\n __do_sys_add_key (security/keys/keyctl.c:134)\n do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n </TASK>\n Kernel panic - not syncing: Fatal exception\n\nReject an asymmetric restriction key without key IDs. A PKCS#8 private\nkey cannot identify the signer of a candidate certificate and is not a\nvalid trust anchor."}], "id": "CVE-2026-99220", "lastModified": "2026-11-03T20:18:27.220", "metrics": {}, "published": "2026-11-02T16:17:46.113", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1aa0c7aa4c2554a5b6d74ae1924508ca4718234b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2a40bdd4409567de4c2a141ac66439dc238af752"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/33a078f04e264eb71aa9f209cb334e4010123818"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/57e54b6939c6539d90a81c7e57531901d5991651"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f0728ba89624e25df2bb80ff59bbfb545060935"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/889a2293a95f6c2880bf73b67f9b0af23251a128"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9695df3b1db4ac4534274d38ee16e3b9b0bf910e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via NULL pointer dereference in asymmetric key restriction", "id": "2565270", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565270"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel. A local, unprivileged attacker could exploit this vulnerability to cause a Denial of Service (DoS) by crashing the system. The issue occurs within the asymmetric key management subsystem when applying restrictions using a key that lacks identifiers, such as a PKCS#8 private key. When an operation subsequently attempts to add a key against this restriction, the kernel unconditionally dereferences an empty identifier field, triggering a null-pointer dereference and kernel panic."], "name": "CVE-2026-99220", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-02T16:06:31Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99220\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99220\nhttps://git.kernel.org/stable/c/1aa0c7aa4c2554a5b6d74ae1924508ca4718234b\nhttps://git.kernel.org/stable/c/2a40bdd4409567de4c2a141ac66439dc238af752\nhttps://git.kernel.org/stable/c/33a078f04e264eb71aa9f209cb334e4010123818\nhttps://git.kernel.org/stable/c/57e54b6939c6539d90a81c7e57531901d5991651\nhttps://git.kernel.org/stable/c/7f0728ba89624e25df2bb80ff59bbfb545060935\nhttps://git.kernel.org/stable/c/889a2293a95f6c2880bf73b67f9b0af23251a128"], "statement": "This vulnerability is rated as having Moderate severity because an unprivileged local user can trigger an immediate denial of service by causing a system crash, but cannot achieve arbitrary code execution, privilege escalation, or data exfiltration. Default enterprise Linux environments permit unprivileged user access to keyring operations, allowing any authenticated local account to invoke keyring restrictions. However, exploitation requires local system access and is strictly confined to crashing the host without compromising data confidentiality or integrity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c58b2362ba828ee2970c66c6a6fd7b04fde4413,889a2293a95f6c2880bf73b67f9b0af23251a128)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c58b2362ba828ee2970c66c6a6fd7b04fde4413,7f0728ba89624e25df2bb80ff59bbfb545060935)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c58b2362ba828ee2970c66c6a6fd7b04fde4413,2a40bdd4409567de4c2a141ac66439dc238af752)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c58b2362ba828ee2970c66c6a6fd7b04fde4413,1aa0c7aa4c2554a5b6d74ae1924508ca4718234b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c58b2362ba828ee2970c66c6a6fd7b04fde4413,33a078f04e264eb71aa9f209cb334e4010123818)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c58b2362ba828ee2970c66c6a6fd7b04fde4413,57e54b6939c6539d90a81c7e57531901d5991651)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.20"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.20)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.191,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.161,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.115,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.60,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.1,7.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c58b2362ba828ee2970c66c6a6fd7b04fde4413,889a2293a95f6c2880bf73b67f9b0af23251a128)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c58b2362ba828ee2970c66c6a6fd7b04fde4413,7f0728ba89624e25df2bb80ff59bbfb545060935)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c58b2362ba828ee2970c66c6a6fd7b04fde4413,2a40bdd4409567de4c2a141ac66439dc238af752)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c58b2362ba828ee2970c66c6a6fd7b04fde4413,1aa0c7aa4c2554a5b6d74ae1924508ca4718234b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c58b2362ba828ee2970c66c6a6fd7b04fde4413,33a078f04e264eb71aa9f209cb334e4010123818)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3c58b2362ba828ee2970c66c6a6fd7b04fde4413,57e54b6939c6539d90a81c7e57531901d5991651)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.20"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.20)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.191,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.161,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.115,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.60,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.1,7.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-02T17:45:11.999833+00:00", "updated": "2026-11-04T14:30:15.630106+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}