Linux keys: unpinned request_key_auth payload lets KEYCTL_INSTANTIATE race into a use-after-free

Impact

The authorisation-key payload used by request_key() upcalls had no refcount. The commit message gives the exact race: while a KEYCTL_INSTANTIATE_IOV caller sleeps on a page fault copying the user payload, the request_key helper can complete, detach and free the rka, and the instantiating thread then dereferences rka->target_key after it is freed. Any local user can drive both sides of this - the keyring upcall path is ordinary unprivileged functionality used by filesystem and network credential helpers. On a shared GPU node this is a use-after-free in core kernel code reachable without any device access at all, so node isolation around /dev/kfd or /dev/nvidia* does not help. Scored 7.8 local by NVD.

Who can reach it

Local unprivileged user, including any container that is not blocked from keyctl() - no device access, no network path, and the race is driven with user-controlled page faults.

What to do

Update to a stable kernel that refcounts the request_key_auth payload and holds a reference across the instantiate and reject paths. There is no configuration mitigation short of blocking keyctl() with seccomp, which breaks credential helpers that use it. Drain and reboot each node to pick up the kernel.

References

Related entries

• Linux KEYS: miscalculated output buffer length overflows on keyctl asymmetric key operationsCVE-2026-63824 · Linux kernel keyring asymmetric key ops (keyctl_pkey_params_get_2)High
• Linux arm64: stale page-table entry left in the walk cache when a hugetlb PMD table is unsharedCVE-2026-63875 · Linux kernel arm64 TLB maintenance (tlb_flush on hugetlb PMD unshare)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-63881 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2026-63884 · Linux i915 GPU kernel driverHigh
• Linux kernel (net/xfrm): Cloning an IPTFS security association kmemdups the mode data, so the clone shares the originalCVE-2026-63911 · Linux kernel (net/xfrm)High
• Linux kernel (net/smc): The SMC socket hashtables are re-initialised at the end of module init, after the protocol andCVE-2026-64005 · Linux kernel (net/smc)High