CVE-2026-99220: Uninitialized Use in GPU
In the Linux kernel, the following vulnerability has been resolved:
asymmetrickeys: reject trust keys without IDs
The PKCS#8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon() unconditionally dereferences that slot when a PKCS#8 key is supplied to a keyorkeyring restriction. Both the plain and :chain forms reach this branch, allowing an unprivileged caller to trigger a NULL pointer dereference through KEYCTLRESTRICTKEYRING followed by addkey().
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:keyorkeyringcommon (crypto/asymmetrickeys/restrict.c:205 crypto/asymmetrickeys/restrict.c:279) Call Trace: <TASK> keycreateorupdate (security/keys/key.c:884) keycreateorupdate (security/keys/key.c:1021) dosysaddkey (security/keys/keyctl.c:134) dosyscall64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:130) </TASK> Kernel panic - not syncing: Fatal exception
Reject an asymmetric restriction key without key IDs. A PKCS#8 private key cannot identify the signer of a candidate certificate and is not a valid trust anchor.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.15-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.161 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.115 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.60 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.14 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.3.1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-8555
- CVE-2026-7906
- CVE-2026-7926
- CVE-2026-7360
- CVE-2026-7355
- CVE-2026-7335
- CVE-2026-11644
- CVE-2026-7910
- CVE-2026-6314
- CVE-2026-6316
- CVE-2026-6312
- CVE-2026-7349
- CVE-2026-6362
- CVE-2026-7908
- CVE-2026-7333
- CVE-2026-10015
- CVE-2026-6317
- CVE-2026-11628
- CVE-2026-3924
- CVE-2026-7341
- CVE-2026-7345
- CVE-2026-7898
- CVE-2026-11643
- CVE-2026-9906
- CVE-2026-10899
- CVE-2026-10972
- CVE-2026-11642
- CVE-2026-10884
- CVE-2026-11638
- CVE-2026-11640
- CVE-2026-10893
- CVE-2026-6313
- CVE-2026-11629
- CVE-2026-11632
- CVE-2026-10886
- CVE-2026-10902
- CVE-2026-10891
- CVE-2026-10895
- CVE-2026-10898
Frequently Asked Questions
Who can trigger the fault, and what access is required?
An unprivileged caller can trigger it. Exploitation requires using KEYCTL_RESTRICT_KEYRING and then add_key() with a PKCS#8 key supplied to a key-or-keyring restriction.
Which keyring restriction forms are affected?
Both the plain key-or-keyring restriction and the :chain form reach the vulnerable branch when a PKCS#8 key is used.
What is the practical impact of successful exploitation?
The vulnerable dereference causes a NULL pointer dereference in the kernel. The supplied crash trace shows this can result in a kernel panic.