UBUNTU-CVE-2026-93106: Use After Free
In the Linux kernel, the following vulnerability has been resolved: crashdump: release keyring reference at the correct time restoredmcryptkeystothreadkeyring() gets a reference to the user keyring before restoring the saved dm-crypt keys. The same keyring reference is then passed to addkeytokeyring() for each saved key, but addkeytokeyring() drops that reference on every call. This is only balanced when exactly one key is restored. With multiple keys, the keyring reference is dropped too many times and may trigger a refcount underflow or use-after-free. When more than five keys are restored, a refcount underflow/use-after-free warning can be triggered. The early error paths after lookupuserkey() also return without dropping the keyring reference. Keep ownership of the keyring reference in restoredmcryptkeystothreadkeyring(), drop it once on all exit paths, and make addkeytokeyring() only use the reference without consuming it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are required to trigger the faulty reference handling?
The crash-dump key restoration path must restore saved dm-crypt keys into a thread keyring. The over-release occurs when multiple keys are restored; warnings for a refcount underflow or use-after-free can be triggered when more than five keys are restored.
What kernel variants are listed as affected?
The listed Ubuntu kernel packages are linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0.
Are there related failure cases besides restoring multiple keys?
Yes. Early error paths after lookup_user_key() can return without releasing the acquired keyring reference, causing a reference leak.