CVE-2026-99220
Description
In the Linux kernel, the following vulnerability has been resolved: asymmetric_keys: reject trust keys without IDs The PKCS#8 parser deliberately leaves the asym_key_ids payload slot empty. key_or_keyring_common() unconditionally dereferences that slot when a PKCS#8 key is supplied to a key_or_keyring restriction. Both the plain and :chain forms reach this branch, allowing an unprivileged caller to trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING followed by add_key(). Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279) Call Trace: <TASK> __key_create_or_update (security/keys/key.c:884) key_create_or_update (security/keys/key.c:1021) __do_sys_add_key (security/keys/keyctl.c:134) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Kernel panic - not syncing: Fatal exception Reject an asymmetric restriction key without key IDs. A PKCS#8 private key cannot identify the signer of a candidate certificate and is not a valid trust anchor.
How to fix
- Linux Linux889a2293a95f6c2880bf73b67f9b0af23251a128, 7f0728ba89624e25df2bb80ff59bbfb545060935, 2a40bdd4409567de4c2a141ac66439dc238af752, 1aa0c7aa4c2554a5b6d74ae1924508ca4718234b, 33a078f04e264eb71aa9f209cb334e4010123818, 57e54b6939c6539d90a81c7e57531901d5991651, 9695df3b1db4ac4534274d38ee16e3b9b0bf910e or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 ≤ v < 889a2293a95f6c2880bf73b67f9b0af23251a128, 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 ≤ v < 7f0728ba89624e25df2bb80ff59bbfb545060935, 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 ≤ v < 2a40bdd4409567de4c2a141ac66439dc238af752, 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 ≤ v < 1aa0c7aa4c2554a5b6d74ae1924508ca4718234b, 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 ≤ v < 33a078f04e264eb71aa9f209cb334e4010123818, 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 ≤ v < 57e54b6939c6539d90a81c7e57531901d5991651, 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 ≤ v < 9695df3b1db4ac4534274d38ee16e3b9b0bf910e, 4.20 | 889a2293a95f6c2880bf73b67f9b0af23251a128, 7f0728ba89624e25df2bb80ff59bbfb545060935, 2a40bdd4409567de4c2a141ac66439dc238af752, 1aa0c7aa4c2554a5b6d74ae1924508ca4718234b, 33a078f04e264eb71aa9f209cb334e4010123818, 57e54b6939c6539d90a81c7e57531901d5991651, 9695df3b1db4ac4534274d38ee16e3b9b0bf910e |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.