CVE-2026-99040 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux systems relying on keyring restrictions should assess exposure and prioritize verification of the fix. This includes reviewing Linux kernel versions, verifying the fix, and monitoring for potential exploitation attempts targeting this vulnerability. Additionally, operators, platform administrators, vulnerability management teams, and security teams should evaluate the impact on A

Why it matters

A race condition vulnerability in the Linux kernel's KEYS system allows a writer with write permission on a destination keyring to link a key despite a reject-all restriction being installed. Linux kernel maintainers and users should assess exposure and prioritize verification of the fix.

• Keyring restriction bypass requires verification from official sources.
• Potential for unauthorized key linking despite restrictions.

Technical summary

The Linux kernel's KEYS system had a race condition vulnerability that allowed a writer to link a key despite a reject-all restriction being installed. The issue was resolved by moving the restrict_link read after __key_link_lock() and __key_link_begin(). The vulnerability was found through manual concurrency analysis assisted by AI-based analysis and independently verified with a QEMU reproducer and kernel instrumentation. This change ensures that the read and the subsequent restriction check are then serialized with restriction installation by keyring->sem, preventing the race condition. Linux kernel maintainers and users should assess exposure and prioritize verification of the fix, especially for systems A

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize verification of the fix, especially for systems relying on keyring restrictions.

Recommended defensive actions

• Review Linux kernel versions and assess exposure based on the provided affected versions.
• Verify the fix by testing keyring restriction functionality.
• Monitor for potential exploitation attempts targeting this vulnerability.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The issue was found through manual concurrency analysis assisted by AI-based analysis and independently verified with a QEMU reproducer and kernel instrumentation. The CVE record and Linux kernel source code provide the primary evidence.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.