Answer in brief
CVE-2026-99040 records a Unknown severity vulnerability in KEYS: Fix add_key() race with keyring restriction. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c <305f1828b871dd46bf41addeb6f11d2c162dcb25 || >=5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c <f99399b48e3edd6851fac34cd329bab9f1f33baf || >=5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c <11516a0c402a6c1fa52254aa70d8d65fb921e59e || >=5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c <da0b595d8e6e2dd798f6e34e09dc51a13b888514 || >=5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c <dd3ea3fcba7c75493760cdbccd35f029597e8d5e | 305f1828b871dd46bf41addeb6f11d2c162dcb25, f99399b48e3edd6851fac34cd329bab9f1f33baf, 11516a0c402a6c1fa52254aa70d8d65fb921e59e, da0b595d8e6e2dd798f6e34e09dc51a13b888514, dd3ea3fcba7c75493760cdbccd35f029597e8d5e |
| Linux/Linuxgeneric | 4.7 | Not reported |
Published upstream
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 23, 2026
In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix add_key() race with keyring restriction __key_create_or_update() snapshots keyring->restrict_link before taking the destination keyring's semaphore. keyring_restrict() installs a restriction while holding that semaphore. This allows a writer to observe no restriction, wait for the keyring owner to install a reject-all restriction and return successfully, and then link a key using the stale NULL snapshot. The writer only needs write permission on the destination keyring. Move the restrict_link read after __key_link_lock() and __key_link_begin(). The read and the subsequent restriction check are then serialized with restriction installation by keyring->sem. The race was reproduced on v7.2.8 in 19 executions where restriction installation returned before the link completed. All 19 linked the key despite the reject-all restriction. With this change, 312 executions reached the same ordering and every add_key() call failed with -EPERM. The issue was found by manual concurrency analysis assisted by AI-based analysis and independently verified with a QEMU reproducer and kernel instrumentation.
Quoted source text, attributed separately from HOL analysis.