SB20261023117 - Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel keys

Description

This security bulletin contains information about 1 vulnerability.

1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-99040)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass keyring restrictions and link keys that should be rejected.

The vulnerability exists due to a time-of-check time-of-use race condition in __key_create_or_update() when reading the destination keyring's restriction before acquiring its semaphore. A local user can issue an add_key() call with write permission on the destination keyring and race the installation of a reject-all restriction to link a key using a stale restriction snapshot after restriction installation has completed.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/11516a0c402a6c1fa52254aa70d8d65fb921e59e
• https://git.kernel.org/stable/c/305f1828b871dd46bf41addeb6f11d2c162dcb25
• https://git.kernel.org/stable/c/da0b595d8e6e2dd798f6e34e09dc51a13b888514
• https://git.kernel.org/stable/c/dd3ea3fcba7c75493760cdbccd35f029597e8d5e
• https://git.kernel.org/stable/c/f99399b48e3edd6851fac34cd329bab9f1f33baf