Linux Kernel: NULL PTR Deref via PKCS#8 Trust Key Restriction (CVE-2026-99220)
CVE-2026-99220 Published on November 2, 2026
asymmetric_keys: reject trust keys without IDs
In the Linux kernel, the following vulnerability has been resolved:
asymmetric_keys: reject trust keys without IDs
The PKCS#8 parser deliberately leaves the asym_key_ids payload slot
empty. key_or_keyring_common() unconditionally dereferences that slot
when a PKCS#8 key is supplied to a key_or_keyring restriction. Both the
plain and :chain forms reach this branch, allowing an unprivileged caller
to trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING
followed by add_key().
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279)
Call Trace:
<TASK>
__key_create_or_update (security/keys/key.c:884)
key_create_or_update (security/keys/key.c:1021)
__do_sys_add_key (security/keys/keyctl.c:134)
do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
</TASK>
Kernel panic - not syncing: Fatal exception
Reject an asymmetric restriction key without key IDs. A PKCS#8 private
key cannot identify the signer of a candidate certificate and is not a
valid trust anchor.
Products Associated with CVE-2026-99220
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 and below 889a2293a95f6c2880bf73b67f9b0af23251a128 is affected.
- Version 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 and below 7f0728ba89624e25df2bb80ff59bbfb545060935 is affected.
- Version 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 and below 2a40bdd4409567de4c2a141ac66439dc238af752 is affected.
- Version 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 and below 1aa0c7aa4c2554a5b6d74ae1924508ca4718234b is affected.
- Version 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 and below 33a078f04e264eb71aa9f209cb334e4010123818 is affected.
- Version 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 and below 57e54b6939c6539d90a81c7e57531901d5991651 is affected.
- Version 4.20 is affected.
- Before 4.20 is unaffected.
- Version 6.1.191, <= 6.1.* is unaffected.
- Version 6.6.161, <= 6.6.* is unaffected.
- Version 6.12.115, <= 6.12.* is unaffected.
- Version 6.18.60, <= 6.18.* is unaffected.
- Version 7.2.14, <= 7.2.* is unaffected.
- Version 7.3.1, <= 7.3.* is unaffected.