UBUNTU-CVE-2026-99220: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: asymmetrickeys: reject trust keys without IDs The PKCS#8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon() unconditionally dereferences that slot when a PKCS#8 key is supplied to a keyorkeyring restriction. Both the plain and :chain forms reach this branch, allowing an unprivileged caller to trigger a NULL pointer dereference through KEYCTLRESTRICTKEYRING followed by addkey(). Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:keyorkeyringcommon (crypto/asymmetrickeys/restrict.c:205 crypto/asymmetrickeys/restrict.c:279) Call Trace: <TASK> keycreateorupdate (security/keys/key.c:884) keycreateorupdate (security/keys/key.c:1021) dosysaddkey (security/keys/keyctl.c:134) dosyscall64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:130) </TASK> Kernel panic - not syncing: Fatal exception Reject an asymmetric restriction key without key IDs. A PKCS#8 private key cannot identify the signer of a candidate certificate and is not a valid trust anchor.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Reject asymmetric restriction keys without key IDs, including PKCS#8 keys, before processing KEYCTL_RESTRICT_KEYRING or add_key().
Event History
Frequently Asked Questions
Who can trigger the crash?
An unprivileged caller can trigger it by using KEYCTL_RESTRICT_KEYRING and then add_key() with a PKCS#8 key. The affected path applies to both plain and :chain key-or-keyring restrictions.
What is the practical impact of successful exploitation?
The vulnerable dereference causes a kernel NULL pointer dereference and can produce an oops or a kernel panic. This is therefore a local denial-of-service condition.
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-fips, ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-aws-fips, and ubuntu/linux-azure-fips.
What condition distinguishes the problematic keys?
The issue occurs when a PKCS#8 key is supplied as a key-or-keyring restriction key without asymmetric key IDs. The PKCS#8 parser leaves the asym_key_ids payload empty, but the affected restriction code dereferences it.