In the Linux kernel, the following vulnerability has been resolved: keys: make keyring indexes independent of kernel addresses KEYCTLREAD…
CVE-2026-99223
In the Linux kernel, the following vulnerability has been resolved: keys: make keyring indexes independent of kernel addresses KEYCTLREAD returns the serial numbers in a keyring in associative-array traversal order. The first word of the index is a public, deterministic hash of the type pointer, domain pointer and description. An unprivileged user can therefore insert keys with known descriptions, predict their order for each possible KASLR slide, and recover the kernel image address. On an x86-64 build with 16 MiB alignment, 45 user keys suffice to distinguish the candidate slides. Remove the addresses from the whole index, not just its first hash word. Assign each key type and domain a nonzero 64-bit ID and hash those IDs and the description with a once-initialized SipHash key. Use the full IDs in the later index chunks as well. Truncating or hashing the IDs there would lose the guarantee that distinct type/domain/description tuples have a differing index bit. Allocate IDs lazily since private key types need not be registered. Cache them in the index key so tree walks and copies of an existing index do not need to dereference a type descriptor that may have been unregistered.…
Assessment
- CVSS
- Not yet scored
- Severity
- Unscored
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 2 November 2026
- Last updated
- 2 November 2026
- Assigner
- Linux
At the source
References
- https://git.kernel.org/stable/c/9ebe824d55983c9f063a2c9ef1a08b29812d406f
- https://git.kernel.org/stable/c/e108b22999edbc6f431466baf6b2016c19b7ed31
- https://git.kernel.org/stable/c/9f084ef0beb68091e96ab96f0e95579aac8a77f9
- https://git.kernel.org/stable/c/8451d4a4c43127c3b9fdf9fc9ff3fea5539a61f9
- https://git.kernel.org/stable/c/13fc051269d670810d9e314061b61c6dd06116a0
- https://git.kernel.org/stable/c/61ac0585d9f4344d3dfb84b5edff1fee7d532897
- https://git.kernel.org/stable/c/84f7c699f8d139f743c7dc11ef41d085690955bb
- https://git.kernel.org/stable/c/a113eba06bd1183c614d7994864d6e7054140cb9
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-99223