DEBIAN-CVE-2026-99220: Null Pointer Dereference

Q: What access does an attacker need to trigger the crash?

An unprivileged caller can trigger the NULL pointer dereference by using KEYCTL_RESTRICT_KEYRING and then add_key() with a PKCS#8 key. Both plain and :chain key-or-keyring restriction forms reach the vulnerable code path.

Q: What is the likely impact of successful exploitation?

The described impact is a kernel NULL pointer dereference that can produce an oops or a kernel panic. This is a denial-of-service condition.

Q: How can administrators reduce exposure if an updated kernel is not immediately available?

The provided information identifies the triggering operations as KEYCTL_RESTRICT_KEYRING followed by add_key() using a PKCS#8 key. Restrict unprivileged users' ability to perform these keyring operations where possible.

Published Nov 2, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: asymmetrickeys: reject trust keys without IDs The PKCS#8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon() unconditionally dereferences that slot when a PKCS#8 key is supplied to a keyorkeyring restriction. Both the plain and :chain forms reach this branch, allowing an unprivileged caller to trigger a NULL pointer dereference through KEYCTLRESTRICTKEYRING followed by addkey(). Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:keyorkeyringcommon (crypto/asymmetrickeys/restrict.c:205 crypto/asymmetrickeys/restrict.c:279) Call Trace: <TASK> keycreateorupdate (security/keys/key.c:884) keycreateorupdate (security/keys/key.c:1021) dosysaddkey (security/keys/keyctl.c:134) dosyscall64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:130) </TASK> Kernel panic - not syncing: Fatal exception Reject an asymmetric restriction key without key IDs. A PKCS#8 private key cannot identify the signer of a candidate certificate and is not a valid trust anchor.

Affected Software

3 affected componentsFixes available

debian/linux*

debian/linux<6.12.115-1

6.12.115-1

debian/linux*

Event History

Nov 2, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionAffected Software

Frequently Asked Questions

What access does an attacker need to trigger the crash?

An unprivileged caller can trigger the NULL pointer dereference by using KEYCTL_RESTRICT_KEYRING and then add_key() with a PKCS#8 key. Both plain and :chain key-or-keyring restriction forms reach the vulnerable code path.

What is the likely impact of successful exploitation?

The described impact is a kernel NULL pointer dereference that can produce an oops or a kernel panic. This is a denial-of-service condition.

How can administrators reduce exposure if an updated kernel is not immediately available?

The provided information identifies the triggering operations as KEYCTL_RESTRICT_KEYRING followed by add_key() using a PKCS#8 key. Restrict unprivileged users' ability to perform these keyring operations where possible.

DEBIAN-CVE-2026-99220: Null Pointer Dereference

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to trigger the crash?

What is the likely impact of successful exploitation?

How can administrators reduce exposure if an updated kernel is not immediately available?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to trigger the crash?

What is the likely impact of successful exploitation?

How can administrators reduce exposure if an updated kernel is not immediately available?