CVE-2026-64015

security/keys: fix missed RCU read section on lookup

State: Published
Severity: 7.8 High
Published: Jul 19, 2026
Updated: Oct 30, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

security/keys: fix missed RCU read section on lookup

Nicholas Carlini reports that the keyring code calls assoc_array_find() in find_key_to_update() without holding the RCU read lock, while the assoc_array_gc() code really is designed around removing the node from the tree and then freeing it after an RCU grace-period.

The regular key handling doesn't see this because holding the keyring semaphore hides any lifetime issues, but the persistent key handling uses a different model.

Instead of extending the keyring locking, just do the simple RCU locking that the assoc_array was designed for.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to before 1d8d987a2aacde238ecd0f4946f28cef74c42b79Affected b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to before 5036a9aa7f21fbce89a2a8451bbc177bae2e920dAffected b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to before 4c5d407ba3ff7f30561ff73ba1b07ed70c864edcAffected b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to before cefa4265b11176c897a7d9e8e54d89e3701c5584Affected b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to before 5659e6923cb72f8e18e8b539109ab512455fe195Affected b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to before 50bb3435a5e627bfbdc52eb4536f49f88b3486b8Affected b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to before 66288dcadf80974436250e9f70ed848836b835b5Affected b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to before 43a1e3744548e6fd85873e6fb43e293eb4010694Affected
LinuxLinux	3.13Affected before 3.13Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.142 through 6.6.Not affected 6.12.92 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to before 1d8d987a2aacde238ecd0f4946f28cef74c42b79Affected
b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to before 5036a9aa7f21fbce89a2a8451bbc177bae2e920dAffected
b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to before 4c5d407ba3ff7f30561ff73ba1b07ed70c864edcAffected
b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to before cefa4265b11176c897a7d9e8e54d89e3701c5584Affected
b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to before 5659e6923cb72f8e18e8b539109ab512455fe195Affected
b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to before 50bb3435a5e627bfbdc52eb4536f49f88b3486b8Affected
b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to before 66288dcadf80974436250e9f70ed848836b835b5Affected
b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 to before 43a1e3744548e6fd85873e6fb43e293eb4010694Affected

LinuxLinux

3.13Affected
before 3.13Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.142 through 6.6.*Not affected
6.12.92 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.