CVE-2026-64015: security/keys: fix missed RCU read section on lookup
In the Linux kernel, the following vulnerability has been resolved:
security/keys: fix missed RCU read section on lookup
Nicholas Carlini reports that the keyring code calls assocarrayfind() in findkeytoupdate() without holding the RCU read lock, while the assocarraygc() code really is designed around removing the node from the tree and then freeing it after an RCU grace-period.
The regular key handling doesn't see this because holding the keyring semaphore hides any lifetime issues, but the persistent key handling uses a different model.
Instead of extending the keyring locking, just do the simple RCU locking that the assocarray was designed for.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add the missing RCU read-side critical section around the keyring assoc_array_find() lookup in find_key_to_update(); use simple RCU locking rather than extending keyring locking.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64015?
CVE-2026-64015 has a risk rating of 44, indicating a moderate level of severity.
How do I fix CVE-2026-64015?
To fix CVE-2026-64015, ensure that you update to the latest version of the Linux kernel where the vulnerability has been addressed.
What systems are affected by CVE-2026-64015?
CVE-2026-64015 affects systems running vulnerable versions of the Linux kernel.
What does CVE-2026-64015 entail?
CVE-2026-64015 involves a missed RCU read lock in the keyring code of the Linux kernel that could lead to inconsistent behavior.
Who reported CVE-2026-64015?
CVE-2026-64015 was reported by Nicholas Carlini.