Linux Kernel (All Versions Prior to Fix) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/linux-kernel-all-versions-prior-to-fix/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 15:58:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLinux Kernel: Use-after-free in keyctl_describe_key (CVE-2026-99224)https://feed.craftedsignal.io/briefs/2026-11-linux-kernel-key-uaf/Thu, 05 Nov 2026 15:58:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-linux-kernel-key-uaf/A race condition in the Linux kernel key management subsystem allows a use-after-free vulnerability during key description retrieval, potentially resulting in kernel-mode page faults.CVE-2026-99224 is a vulnerability in the Linux kernel key management subsystem. Specifically, the function keyctl_describe_key fails to properly pin the memory associated with a key type's name during the formatting process. If a module providing a key type is unloaded concurrently with a key description request, the kernel may attempt to access memory from the released module, leading to a use-after-free condition and a potential kernel panic or page fault.

Impact

Successful exploitation of this race condition can cause a kernel-mode page fault. In a local context, this can lead to a system crash (Denial of Service). While the provided information focuses on the crash, the access to freed memory storage suggests potential for further memory corruption depending on system state.

Recommendation

  1. Identify systems running Linux kernel versions susceptible to this race condition.
  2. Monitor kernel logs (dmesg) for page fault errors related to memory addresses within loaded modules, particularly involving key management operations.
  3. Patch the Linux kernel to the version containing the fix for CVE-2026-99224 once the stable release becomes available from your distribution vendor.
]]>highadvisory