Tracker / CVE-2026-63823
CVE-2026-63823
In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payload in instantiate paths A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ ========================= create auth key store rka in auth key wait for helper get auth key load rka from auth key copy user payload sleep on #PF helper completed detach and free rka destroy auth key wake up use rka->target_key **USE-AFTER-FREE** Give request_key_auth payloads a refcount. Take a payload reference while authkey->sem stabilizes the payload and revocation state. Hold that reference across the instantiate and reject paths. Drop the auth key owning reference from revoke and destroy. [jarkko: Replaced the first two paragraphs of text with an actual concurrency scenario.]
Prodotti e versioni affette
| linux | linux_kernel · 2.6.16 → 5.10.260 |
|---|---|
| linux | linux_kernel · 5.11 → 5.15.211 |
| linux | linux_kernel · 5.16 → 6.1.177 |
| linux | linux_kernel · 6.13 → 6.18.38 |
| linux | linux_kernel · 6.19 → 7.1.3 |
| linux | linux_kernel · 6.2 → 6.6.144 |
| linux | linux_kernel · 6.7 → 6.12.95 |