CVE-2026-99220
asymmetric_keys: reject trust keys without IDs
What happened?
In the Linux kernel, the following vulnerability has been resolved:
asymmetric_keys: reject trust keys without IDs
The PKCS#8 parser deliberately leaves the asym_key_ids payload slot empty. key_or_keyring_common() unconditionally dereferences that slot when a PKCS#8 key is supplied to a key_or_keyring restriction. Both the plain and :chain forms reach this branch, allowing an unprivileged caller to trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING followed by add_key().
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279) Call Trace: <TASK> __key_create_or_update (security/keys/key.c:884) key_create_or_update (security/keys/key.c:1021) __do_sys_add_key (security/keys/keyctl.c:134) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Kernel panic - not syncing: Fatal exception
Reject an asymmetric restriction key without key IDs. A PKCS#8 private key cannot identify the signer of a candidate certificate and is not a valid trust anchor.
Affected software and versions
| Software | Version information | Fixed version |
|---|---|---|
| LinuxLinux | affected: 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 to < 889a2293a95f6c2880bf73b67f9b0af23251a128; affected: 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 to < 7f0728ba89624e25df2bb80ff59bbfb545060935; affected: 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 to < 2a40bdd4409567de4c2a141ac66439dc238af752; affected: 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 to < 1aa0c7aa4c2554a5b6d74ae1924508ca4718234b; affected: 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 to < 33a078f04e264eb71aa9f209cb334e4010123818; affected: 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 to < 57e54b6939c6539d90a81c7e57531901d5991651; affected: 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 to < 9695df3b1db4ac4534274d38ee16e3b9b0bf910e | See vendor advisory |
| LinuxLinux | affected: 4.20; unaffected: 0 to < 4.20; unaffected: 6.1.191 to ≤ 6.1.*; unaffected: 6.6.161 to ≤ 6.6.*; unaffected: 6.12.115 to ≤ 6.12.*; unaffected: 6.18.60 to ≤ 6.18.*; unaffected: 7.2.14 to ≤ 7.2.*; unaffected: 7.3.1 to ≤ 7.3.*; unaffected: 7.4-rc1 to ≤ * | See vendor advisory |
Version information comes from the source record and can include unaffected products and exceptions. Distribution packages may contain backported fixes: an older upstream version alone does not prove a server is affected.
Is it being exploited?
This CVE was not listed in the CISA catalogue at our last retrieval. This does not establish that exploitation is absent.
How to respond
- Confirm the product, installed package version, and any configuration requirements in the vendor advisory.
- Follow the vendor’s remediation or workaround guidance in the references below. Structured fixed-version data is unavailable here; the publisher’s description may include a fix or workaround.
- Restart affected services if required, then verify the running version. Known exploitation may warrant investigation as well as patching.
Sources and remediation references
- https://www.cve.org/CVERecord?id=CVE-2026-99220
- https://git.kernel.org/stable/c/889a2293a95f6c2880bf73b67f9b0af23251a128
- https://git.kernel.org/stable/c/7f0728ba89624e25df2bb80ff59bbfb545060935
- https://git.kernel.org/stable/c/2a40bdd4409567de4c2a141ac66439dc238af752
- https://git.kernel.org/stable/c/1aa0c7aa4c2554a5b6d74ae1924508ca4718234b
- https://git.kernel.org/stable/c/33a078f04e264eb71aa9f209cb334e4010123818
- https://git.kernel.org/stable/c/57e54b6939c6539d90a81c7e57531901d5991651
- https://git.kernel.org/stable/c/9695df3b1db4ac4534274d38ee16e3b9b0bf910e