7.8

CVE-2026-64015

security/keys: fix missed RCU read section on lookup

In the Linux kernel, the following vulnerability has been resolved:

security/keys: fix missed RCU read section on lookup

Nicholas Carlini reports that the keyring code calls assoc_array_find()
in find_key_to_update() without holding the RCU read lock, while the
assoc_array_gc() code really is designed around removing the node from
the tree and then freeing it after an RCU grace-period.

The regular key handling doesn't see this because holding the keyring
semaphore hides any lifetime issues, but the persistent key handling
uses a different model.

Instead of extending the keyring locking, just do the simple RCU locking
that the assoc_array was designed for.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 3.13 < 6.1.175
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.142
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.92
Linux ≫ Linux Kernel Version >= 6.13 < 6.18.34
Linux ≫ Linux Kernel Version >= 6.19 < 7.0.11
Linux ≫ Linux Kernel Version 7.1 Update rc1
Linux ≫ Linux Kernel Version 7.1 Update rc2
Linux ≫ Linux Kernel Version 7.1 Update rc3
Linux ≫ Linux Kernel Version 7.1 Update rc4
Linux ≫ Linux Kernel Version 7.1 Update rc5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.029
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

https://git.kernel.org/stable/c/4c5d407ba3ff7f30561ff73ba1b07ed70c864edc
Patch
https://git.kernel.org/stable/c/cefa4265b11176c897a7d9e8e54d89e3701c5584
Patch
https://git.kernel.org/stable/c/5659e6923cb72f8e18e8b539109ab512455fe195
Patch
https://git.kernel.org/stable/c/50bb3435a5e627bfbdc52eb4536f49f88b3486b8
Patch
https://git.kernel.org/stable/c/66288dcadf80974436250e9f70ed848836b835b5
Patch
https://git.kernel.org/stable/c/43a1e3744548e6fd85873e6fb43e293eb4010694
Patch