CVE-2026-99245None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: KEYS: Fix key_reject_and_link() race with keyring restriction The restrict_link check in key_reject_and_link() is done before taking the keyring semaphore, racing with…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
In the Linux kernel, the following vulnerability has been resolved:
KEYS: Fix key_reject_and_link() race with keyring restriction
The restrict_link check in key_reject_and_link() is done before taking the keyring semaphore, racing with a concurrent keyring_restrict() that installs the restriction while holding the semaphore in write mode.
Move the check to after __key_link_lock(), so it is done under the semaphore, matching the pattern used in __key_create_or_update().
Linux >= 5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c < c7956ec99ad0e173720d95de9fa788bb077809f2Linux >= 5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c < 2c3d907dd15f4e30d4c35b9f7a7a5078de6a1b1fLinux >= 5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c < 72f367417a6aee56821d0b0114cfd2b080008b63Linux >= 5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c < 19dfc37c9deefa69dc805d01d35d1f2fd7902e33Linux >= 5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c < 5787887eba0f0979a8c86d03a8e891395d5c24adLinux >= 5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c < 01835d3a3709be508ae5209f806640336c48e395Linux >= 5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c < 6fc0c818b1cac66003e937c8a0d3bfb23fd3f130Linux >= 5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c < 23a9163cc40b4996ba1e20533b1210a1a0bee416Linux >= 5ac7eace2d00eab5ae0e9fdee63e38aee6001f7c < 0b157166e612b70f98a332b6c7be7eac6f8e9593Linux 4.7Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses