Linux kernel keys: keyring ordering leaks kernel addresses, defeating KASLR for a local user

Impact

KEYCTL_READ returns a keyring's serial numbers in associative-array traversal order, and the index is a public, deterministic hash of the key type pointer, the domain pointer and the description. An unprivileged user can insert keys with descriptions they choose, observe the resulting order, and recover the kernel image base: the changelog states that on an x86-64 build with 16 MiB alignment, 45 user keys are enough to pick the KASLR slide out of the candidates. This is an information leak, not a crash or an escalation, but it removes the randomisation that other local bugs have to guess - on a shared GPU node where tenants get real processes, it turns a probabilistic local exploit into a reliable one. The fix replaces the address-derived index with per-type and per-domain 64-bit IDs hashed under a SipHash key; userspace data format and permissions are unchanged.

Who can reach it

Local, unprivileged. Any user who can add keys to a keyring and read it back with keyctl - no authentication beyond a shell or code execution on the node, including inside a container that has not masked keyctl.

What to do

Update the host kernel to a stable release carrying the fix and reboot the node; there is no runtime toggle for the index layout. Drain GPU workloads before the reboot. Only stable commits are in the record - confirm the fixed version with your kernel vendor before planning the window.

References

Related entries

• Linux kernel keys: NULL authorization payload dereferenced during a process keyring search, oopsing the hostCVE-2026-99225 · Linux kernel keys (request-key authorization payload in search_process_keyrings_rcu)Unscored
• ProFTPD mod_copy: unauthenticated SITE CPFR/CPTO gives arbitrary file read and writeCVE-2015-3306 · ProFTPD mod_copy (SITE CPFR / SITE CPTO)Critical
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• glibc through 2.29: heap buffer over-read in regexec during case-insensitive regex matchingCVE-2019-9169 · glibc regexec (proceed_next_node, case-insensitive matching)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical