CVE-2026-93106: crash_dump: release keyring reference at the correct time
In the Linux kernel, the following vulnerability has been resolved:
crashdump: release keyring reference at the correct time
restoredmcryptkeystothreadkeyring() gets a reference to the user keyring before restoring the saved dm-crypt keys.
The same keyring reference is then passed to addkeytokeyring() for each saved key, but addkeytokeyring() drops that reference on every call. This is only balanced when exactly one key is restored. With multiple keys, the keyring reference is dropped too many times and may trigger a refcount underflow or use-after-free.
When more than five keys are restored, a refcount underflow/use-after-free warning can be triggered.
The early error paths after lookupuserkey() also return without dropping the keyring reference.
Keep ownership of the keyring reference in restoredmcryptkeystothreadkeyring(), drop it once on all exit paths, and make addkeytokeyring() only use the reference without consuming it.
Affected Software
Event History
Frequently Asked Questions
Which systems should be prioritized for assessment?
Prioritize Linux kernel systems that restore saved dm-crypt keys as part of crash-dump handling. The reference-management flaw occurs when multiple saved keys are restored; the available data does not establish whether this path is enabled or reached by default.
What evidence could indicate that the issue has been triggered?
Restoring more than five keys can trigger a refcount-underflow or use-after-free warning. With multiple restored keys, the keyring reference may be dropped too many times even if no warning is observed.