Details
- Type
- Use After Free
- Impact
- Denial Of Service
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Published
- 2 November 2026
- Updated
- 3 November 2026
Vendor fix
Update to the latest Linux kernel version containing the fix for keyctl_describe_key() key type name handling.
Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-99224
- https://git.kernel.org/stable/c/3c3cfd9e262afc9558c38f8cec57f09d10988546
- https://git.kernel.org/stable/c/6b613747f7ea309ada5b8d05b55398c338f7a968
- https://git.kernel.org/stable/c/916667df7695366f23cfaf365b5840b228cc4b2e
- https://git.kernel.org/stable/c/a49e6c9a1a5b3457c946a8efb616ce13b4ca8194
- https://git.kernel.org/stable/c/dddd3a1ab7d12ee163477918ff6eb943361db4fe
- https://git.kernel.org/stable/c/dea367df18e3a4faac393e3a4e818ee03af89b19
- https://git.kernel.org/stable/c/0461bc8f91116aae4a020e15f4e1c1fd535ab35e
- https://git.kernel.org/stable/c/19c4de819e52b7f606468fbfe4fcef4e812e2777