Linux kernel keys: NULL authorization payload dereferenced during a process keyring search, oopsing the host

Impact

search_process_keyrings_rcu() validates the request-key authorization key, then separately loads payload.data[0] and dereferences rka->cred without checking it. A request-key helper can assume authority and fork a descendant that inherits the authorization key; when the requester resumes and calls complete_request_key(), revocation clears the payload pointer while the descendant is mid-search, and the descendant dereferences NULL. The KASAN report in the record shows a general protection fault in search_process_keyrings_rcu. This is a host or node crash, not a privilege escalation: on a GPU node it means an unplanned reboot and a lost training step or a tenant's in-flight job, and GPU nodes are not cheap to drain. Exploitation needs the right interleaving of a request-key helper, its descendant and the requester, so it is a race rather than a one-shot.

Who can reach it

Local. A user who can drive request-key upcalls and fork from the helper's descendant; no remote path and no special privilege is described beyond running code on the node.

What to do

Update the host kernel to a stable release carrying the fix (payload loaded with dereference_key_rcu() and required non-NULL before the search) and reboot the node - drain GPU workloads first. The record carries only stable commits, no distro fixed versions, so check your vendor's kernel errata before scheduling the window.

References

Related entries

• ProFTPD mod_copy: unauthenticated SITE CPFR/CPTO gives arbitrary file read and writeCVE-2015-3306 · ProFTPD mod_copy (SITE CPFR / SITE CPTO)Critical
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• glibc through 2.29: heap buffer over-read in regexec during case-insensitive regex matchingCVE-2019-9169 · glibc regexec (proceed_next_node, case-insensitive matching)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• glibc 2.32/2.33: use-after-free in mq_notify of the caller's notification thread attributesCVE-2021-33574 · glibc mq_notify (POSIX message queue notification thread attributes)Critical