CVE-2026-99040 KEYS: Fix add_key() race with keyring restriction
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99040?
CVE-2026-99040 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KEYS: Fix add_key() race with keyring restriction
__key_create_or_update() snapshots keyring->restrict_link before taking the destination keyring's semaphore. keyring_restrict() installs a restriction while holding that semaphore.
This allows a writer to observe no restriction, wait for the keyring owner to install a reject-all restriction and return successfully, and then link a key using the stale NULL snapshot. The writer only needs write permission on the destination keyring.
Move the restrict_link read after __key_link_lock() and __key_link_begin(). The read and the subsequent restriction check are then serialized with restriction installation by keyring->sem.
The race was reproduced on v7.2.8 in 19 executions where restriction installation returned before the link completed. All 19 linked the key despite the reject-all restriction. With this change, 312 executions reached the same ordering and every add_key() call failed with -EPERM.
The issue was found by manual concurrency analysis assisted by AI-based analysis and independently verified with a QEMU reproducer and kernel instrumentation.
Which versions are affected by CVE-2026-99040?
How do I fix CVE-2026-99040?
Upgrade to a fixed version.
Is CVE-2026-99040 being exploited?
There is no known exploitation of CVE-2026-99040 in the wild and no public exploit code.
Sources
Also known as AZL-110915, BELL-CVE-2026-99040, DEBIAN-CVE-2026-99040, GHSA-xfxp-jqfr-m4g5, UBUNTU-CVE-2026-99040.