---
id: CVE-2026-99220
title: 'asymmetric_keys: reject trust keys without IDs'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  asymmetric_keys: reject trust keys without IDs

  The PKCS#8 parser deliberately leaves the asym_key_ids payload slot
  empty. key_or_keyring_common() unconditionally deref…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 <
    889a2293a95f6c2880bf73b67f9b0af23251a128
  - >-
    Linux >= 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 <
    7f0728ba89624e25df2bb80ff59bbfb545060935
  - >-
    Linux >= 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 <
    2a40bdd4409567de4c2a141ac66439dc238af752
  - >-
    Linux >= 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 <
    1aa0c7aa4c2554a5b6d74ae1924508ca4718234b
  - >-
    Linux >= 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 <
    33a078f04e264eb71aa9f209cb334e4010123818
  - >-
    Linux >= 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 <
    57e54b6939c6539d90a81c7e57531901d5991651
  - >-
    Linux >= 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 <
    9695df3b1db4ac4534274d38ee16e3b9b0bf910e
  - Linux 4.20
published: '2026-11-02'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:12:54.971Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99220'
references:
  - url: 'https://git.kernel.org/stable/c/889a2293a95f6c2880bf73b67f9b0af23251a128'
  - url: 'https://git.kernel.org/stable/c/7f0728ba89624e25df2bb80ff59bbfb545060935'
  - url: 'https://git.kernel.org/stable/c/2a40bdd4409567de4c2a141ac66439dc238af752'
  - url: 'https://git.kernel.org/stable/c/1aa0c7aa4c2554a5b6d74ae1924508ca4718234b'
  - url: 'https://git.kernel.org/stable/c/33a078f04e264eb71aa9f209cb334e4010123818'
  - url: 'https://git.kernel.org/stable/c/57e54b6939c6539d90a81c7e57531901d5991651'
  - url: 'https://git.kernel.org/stable/c/9695df3b1db4ac4534274d38ee16e3b9b0bf910e'
tags:
  - cve.org
epss: 0.00122
epssPercentile: 0.01955
ingestedAt: '2026-11-05T20:33:06.379Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

asymmetric_keys: reject trust keys without IDs

The PKCS#8 parser deliberately leaves the asym_key_ids payload slot
empty. key_or_keyring_common() unconditionally dereferences that slot
when a PKCS#8 key is supplied to a key_or_keyring restriction. Both the
plain and :chain forms reach this branch, allowing an unprivileged caller
to trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING
followed by add_key().

 Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000
 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
 RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279)
 Call Trace:
  <TASK>
  __key_create_or_update (security/keys/key.c:884)
  key_create_or_update (security/keys/key.c:1021)
  __do_sys_add_key (security/keys/keyctl.c:134)
  do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
  </TASK>
 Kernel panic - not syncing: Fatal exception

Reject an asymmetric restriction key without key IDs. A PKCS#8 private
key cannot identify the signer of a candidate certificate and is not a
valid trust anchor.

## Affected

- `Linux >= 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 < 889a2293a95f6c2880bf73b67f9b0af23251a128`
- `Linux >= 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 < 7f0728ba89624e25df2bb80ff59bbfb545060935`
- `Linux >= 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 < 2a40bdd4409567de4c2a141ac66439dc238af752`
- `Linux >= 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 < 1aa0c7aa4c2554a5b6d74ae1924508ca4718234b`
- `Linux >= 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 < 33a078f04e264eb71aa9f209cb334e4010123818`
- `Linux >= 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 < 57e54b6939c6539d90a81c7e57531901d5991651`
- `Linux >= 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 < 9695df3b1db4ac4534274d38ee16e3b9b0bf910e`
- `Linux 4.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.