Exploitation evidence
Not listed in the latest downloaded CISA KEV catalog. This does not establish an absence of exploitation.
KEV checked 13 Nov 2026, 00:20 Jerusalem · Original catalog ↗Reported products and versions
Linux / Linux
Default status: unaffected
- affected: 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 to < 889a2293a95f6c2880bf73b67f9b0af23251a128 (git)
- affected: 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 to < 7f0728ba89624e25df2bb80ff59bbfb545060935 (git)
- affected: 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 to < 2a40bdd4409567de4c2a141ac66439dc238af752 (git)
- affected: 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 to < 1aa0c7aa4c2554a5b6d74ae1924508ca4718234b (git)
- affected: 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 to < 33a078f04e264eb71aa9f209cb334e4010123818 (git)
- affected: 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 to < 57e54b6939c6539d90a81c7e57531901d5991651 (git)
- affected: 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 to < 9695df3b1db4ac4534274d38ee16e3b9b0bf910e (git)
Linux / Linux
Default status: affected
- affected: 4.20
- unaffected: 0 to < 4.20 (semver)
- unaffected: 6.1.191 to ≤ 6.1.* (semver)
- unaffected: 6.6.161 to ≤ 6.6.* (semver)
- unaffected: 6.12.115 to ≤ 6.12.* (semver)
- unaffected: 6.18.60 to ≤ 6.18.* (semver)
- unaffected: 7.2.14 to ≤ 7.2.* (semver)
- unaffected: 7.3.1 to ≤ 7.3.* (semver)
- unaffected: 7.4-rc1 to ≤ * (original_commit_for_fix)
Fixes and workarounds
No explicit solution text in the downloaded CVE record. Consult the vendor advisory; unaffected version ranges are shown above as reported, not inferred as a patch recommendation.
Sources and related reporting
CVE Program record ↗ · Download tracked evidence as JSON
- https://git.kernel.org/stable/c/889a2293a95f6c2880bf73b67f9b0af23251a128
- https://git.kernel.org/stable/c/7f0728ba89624e25df2bb80ff59bbfb545060935
- https://git.kernel.org/stable/c/2a40bdd4409567de4c2a141ac66439dc238af752
- https://git.kernel.org/stable/c/1aa0c7aa4c2554a5b6d74ae1924508ca4718234b
- https://git.kernel.org/stable/c/33a078f04e264eb71aa9f209cb334e4010123818
- https://git.kernel.org/stable/c/57e54b6939c6539d90a81c7e57531901d5991651
- https://git.kernel.org/stable/c/9695df3b1db4ac4534274d38ee16e3b9b0bf910e
Monitored source mentions
Shared CVE identifiers link source mentions; they do not establish that the reports describe the same incident.
Observed change timeline
History begins when Egret first downloads each source. It is not the complete upstream CVE history.
12 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-12",
"epss": 0.00122,
"percentile": 0.01972
}11 Nov 2026, 12:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-10",
"epss": 0.00122,
"percentile": 0.01957
}11 Nov 2026, 12:20 Jerusalem · CVE Program record changed
Stored CNA snapshot at this observation.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/asymmetric_keys/restrict.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "889a2293a95f6c2880bf73b67f9b0af23251a128",
"status": "affected",
"version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413",
"versionType": "git"
},
{
"lessThan": "7f0728ba89624e25df2bb80ff59bbfb545060935",
"status": "affected",
"version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413",
"versionType": "git"
},
{
"lessThan": "2a40bdd4409567de4c2a141ac66439dc238af752",
"status": "affected",
"version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413",
"versionType": "git"
},
{
"lessThan": "1aa0c7aa4c2554a5b6d74ae1924508ca4718234b",
"status": "affected",
"version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413",
"versionType": "git"
},
{
"lessThan": "33a078f04e264eb71aa9f209cb334e4010123818",
"status": "affected",
"version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413",
"versionType": "git"
},
{
"lessThan": "57e54b6939c6539d90a81c7e57531901d5991651",
"status": "affected",
"version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413",
"versionType": "git"
},
{
"lessThan": "9695df3b1db4ac4534274d38ee16e3b9b0bf910e",
"status": "affected",
"version": "3c58b2362ba828ee2970c66c6a6fd7b04fde4413",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/asymmetric_keys/restrict.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.*",
"status": "unaffected",
"version": "7.3.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.4-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.60",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.14",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3.1",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.4-rc1",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nasymmetric_keys: reject trust keys without IDs\n\nThe PKCS#8 parser deliberately leaves the asym_key_ids payload slot\nempty. key_or_keyring_common() unconditionally dereferences that slot\nwhen a PKCS#8 key is supplied to a key_or_keyring restriction. Both the\nplain and :chain forms reach this branch, allowing an unprivileged caller\nto trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING\nfollowed by add_key().\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279)\n Call Trace:\n <TASK>\n __key_create_or_update (security/keys/key.c:884)\n key_create_or_update (security/keys/key.c:1021)\n __do_sys_add_key (security/keys/keyctl.c:134)\n do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n </TASK>\n Kernel panic - not syncing: Fatal exception\n\nReject an asymmetric restriction key without key IDs. A PKCS#8 private\nkey cannot identify the signer of a candidate certificate and is not a\nvalid trust anchor."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T19:12:54.971Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/889a2293a95f6c2880bf73b67f9b0af23251a128"
},
{
"url": "https://git.kernel.org/stable/c/7f0728ba89624e25df2bb80ff59bbfb545060935"
},
{
"url": "https://git.kernel.org/stable/c/2a40bdd4409567de4c2a141ac66439dc238af752"
},
{
"url": "https://git.kernel.org/stable/c/1aa0c7aa4c2554a5b6d74ae1924508ca4718234b"
},
{
"url": "https://git.kernel.org/stable/c/33a078f04e264eb71aa9f209cb334e4010123818"
},
{
"url": "https://git.kernel.org/stable/c/57e54b6939c6539d90a81c7e57531901d5991651"
},
{
"url": "https://git.kernel.org/stable/c/9695df3b1db4ac4534274d38ee16e3b9b0bf910e"
}
],
"title": "asymmetric_keys: reject trust keys without IDs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99220",
"datePublished": "2026-11-02T16:06:31.966Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-11-03T19:12:54.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}