{"id":"AZL-110915","summary":"CVE-2026-99040 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: Fix add_key() race with keyring restriction\n\n__key_create_or_update() snapshots keyring-\u003erestrict_link before taking\nthe destination keyring's semaphore.  keyring_restrict() installs a\nrestriction while holding that semaphore.\n\nThis allows a writer to observe no restriction, wait for the keyring\nowner to install a reject-all restriction and return successfully, and\nthen link a key using the stale NULL snapshot.  The writer only needs\nwrite permission on the destination keyring.\n\nMove the restrict_link read after __key_link_lock() and\n__key_link_begin().  The read and the subsequent restriction check are\nthen serialized with restriction installation by keyring-\u003esem.\n\nThe race was reproduced on v7.2.8 in 19 executions where restriction\ninstallation returned before the link completed.  All 19 linked the key\ndespite the reject-all restriction.  With this change, 312 executions\nreached the same ordering and every add_key() call failed with -EPERM.\n\nThe issue was found by manual concurrency analysis assisted by AI-based\nanalysis and independently verified with a QEMU reproducer and kernel\ninstrumentation.","modified":"2026-10-25T05:30:37Z","published":"2026-10-23T13:17:27Z","upstream":["CVE-2026-99040"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99040"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110915.json"}}],"schema_version":"1.9.0"}