PT-2026-61332 · Linux · Linux

CVE-2026-64015 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

security/keys: fix missed RCU read section on lookup

Nicholas Carlini reports that the keyring code calls assoc array find() in find key to update() without holding the RCU read lock, while the assoc array gc() code really is designed around removing the node from the tree and then freeing it after an RCU grace-period.

The regular key handling doesn't see this because holding the keyring semaphore hides any lifetime issues, but the persistent key handling uses a different model.

Instead of extending the keyring locking, just do the simple RCU locking that the assoc array was designed for.

Fix

Related Identifiers

CVE-2026-64015

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-64015 · Security Note
• https://git.kernel.org/stable/c/50bb3435a5e627bfbdc52eb4536f49f88b3486b8 · Note
• https://git.kernel.org/stable/c/4c5d407ba3ff7f30561ff73ba1b07ed70c864edc · Note
• https://git.kernel.org/stable/c/43a1e3744548e6fd85873e6fb43e293eb4010694 · Note
• https://git.kernel.org/stable/c/66288dcadf80974436250e9f70ed848836b835b5 · Note
• https://git.kernel.org/stable/c/cefa4265b11176c897a7d9e8e54d89e3701c5584 · Note
• https://git.kernel.org/stable/c/5659e6923cb72f8e18e8b539109ab512455fe195 · Note