Linux kernel keys: read method checked outside key->sem, so KEYCTL_READ can touch a freed key type module

Impact

keyctl_read_key() read key->type->read without holding key->sem. Holding a reference keeps the key alive but does not pin the module that owns its type, so a surviving key - the worked example is an RxRPC key - can be read while its module is unloaded: the key GC retypes the key, unregister_key_type() returns, free_module() runs, and the reader then uses the saved type's read member out of freed module storage. The read invocation itself was already under key->sem; only the earlier method check was not. The practical exposure on a server is a use-after-free in kernel memory reached from an unprivileged keyctl call, which means at minimum a node crash. It needs the type's module to actually be unloading, which on a headless GPU node with a static module set is rare - this is primarily a bug for hosts where key-type modules come and go.

Who can reach it

Local, unprivileged: a user calling KEYCTL_READ on a key whose type module is being unregistered at that moment. No remote path.

What to do

Take the stable kernel fix (the method check moves into __keyctl_read_key() under the existing read hold on key->sem) and reboot the node after draining GPU work. Until then, not unloading key-type modules such as af_rxrpc on running nodes removes the window. The record has stable commits only; no distro fixed versions are stated.

References

Related entries

• Linux kernel keys: keyring ordering leaks kernel addresses, defeating KASLR for a local userCVE-2026-99223 · Linux kernel keys (keyring associative-array index derived from kernel addresses)Unscored
• Linux kernel keys: NULL authorization payload dereferenced during a process keyring search, oopsing the hostCVE-2026-99225 · Linux kernel keys (request-key authorization payload in search_process_keyrings_rcu)Unscored
• ProFTPD mod_copy: unauthenticated SITE CPFR/CPTO gives arbitrary file read and writeCVE-2015-3306 · ProFTPD mod_copy (SITE CPFR / SITE CPTO)Critical
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• glibc through 2.29: heap buffer over-read in regexec during case-insensitive regex matchingCVE-2019-9169 · glibc regexec (proceed_next_node, case-insensitive matching)Critical