Exploitation evidence
Not listed in the latest downloaded CISA KEV catalog. This does not establish an absence of exploitation.
KEV checked 13 Nov 2026, 00:20 Jerusalem · Original catalog ↗Reported products and versions
Linux / Linux
Default status: unaffected
- affected: d3ec10aa95819bff18a0d936b18884c7816d0914 to < e5f830ae6611cddbfc504c43f14155f60b63206a (git)
- affected: d3ec10aa95819bff18a0d936b18884c7816d0914 to < ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d (git)
- affected: d3ec10aa95819bff18a0d936b18884c7816d0914 to < 1486caee47b4909f52835a957c3293e970113e44 (git)
- affected: d3ec10aa95819bff18a0d936b18884c7816d0914 to < ff44f1b303aa76a818d898e85c56ed4852c031e2 (git)
- affected: d3ec10aa95819bff18a0d936b18884c7816d0914 to < 6a36e2a1a017c51f8a8ad2a094566bad97c46a9b (git)
- affected: d3ec10aa95819bff18a0d936b18884c7816d0914 to < 3edc064069d07e7d37359fcb4d03d3bab15ee3ab (git)
- affected: d3ec10aa95819bff18a0d936b18884c7816d0914 to < cf1af7df80e38bf58bd74c2cccce32fcbd1a596a (git)
- affected: d3ec10aa95819bff18a0d936b18884c7816d0914 to < e2a2deda08d91644f5e30c17d267b1cdc5f124b2 (git)
- affected: d3ec10aa95819bff18a0d936b18884c7816d0914 to < 925c84e3cc21caf09de92d9bcafab0147790debf (git)
- affected: 7fa67aa30509ad0da72ac0f757aa76e53c0ea3de (git)
- affected: 18779eac17b5df9dff57138d07631573553a41d4 (git)
- affected: f1afcf9488fc45765e20e2047d3b776981900e0b (git)
- affected: 212d3adb1af4e34acb158d6c6def370016a1011d (git)
- affected: 4.14.177 to < 4.15 (semver)
- affected: 4.19.118 to < 4.20 (semver)
- affected: 5.4.35 to < 5.5 (semver)
- affected: 5.6.7 to < 5.7 (semver)
Linux / Linux
Default status: affected
- affected: 5.7
- unaffected: 0 to < 5.7 (semver)
- unaffected: 5.10.273 to ≤ 5.10.* (semver)
- unaffected: 5.15.224 to ≤ 5.15.* (semver)
- unaffected: 6.1.191 to ≤ 6.1.* (semver)
- unaffected: 6.6.161 to ≤ 6.6.* (semver)
- unaffected: 6.12.115 to ≤ 6.12.* (semver)
- unaffected: 6.18.60 to ≤ 6.18.* (semver)
- unaffected: 7.2.14 to ≤ 7.2.* (semver)
- unaffected: 7.3.1 to ≤ 7.3.* (semver)
- unaffected: 7.4-rc1 to ≤ * (original_commit_for_fix)
Fixes and workarounds
No explicit solution text in the downloaded CVE record. Consult the vendor advisory; unaffected version ranges are shown above as reported, not inferred as a patch recommendation.
Sources and related reporting
CVE Program record ↗ · Download tracked evidence as JSON
- https://git.kernel.org/stable/c/e5f830ae6611cddbfc504c43f14155f60b63206a
- https://git.kernel.org/stable/c/ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d
- https://git.kernel.org/stable/c/1486caee47b4909f52835a957c3293e970113e44
- https://git.kernel.org/stable/c/ff44f1b303aa76a818d898e85c56ed4852c031e2
- https://git.kernel.org/stable/c/6a36e2a1a017c51f8a8ad2a094566bad97c46a9b
- https://git.kernel.org/stable/c/3edc064069d07e7d37359fcb4d03d3bab15ee3ab
- https://git.kernel.org/stable/c/cf1af7df80e38bf58bd74c2cccce32fcbd1a596a
- https://git.kernel.org/stable/c/e2a2deda08d91644f5e30c17d267b1cdc5f124b2
- https://git.kernel.org/stable/c/925c84e3cc21caf09de92d9bcafab0147790debf
Monitored source mentions
Shared CVE identifiers link source mentions; they do not establish that the reports describe the same incident.
Observed change timeline
History begins when Egret first downloads each source. It is not the complete upstream CVE history.
12 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-12",
"epss": 0.00182,
"percentile": 0.07894
}11 Nov 2026, 12:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-10",
"epss": 0.00182,
"percentile": 0.07878
}11 Nov 2026, 12:20 Jerusalem · CVE Program record changed
Stored CNA snapshot at this observation.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/keys/keyctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e5f830ae6611cddbfc504c43f14155f60b63206a",
"status": "affected",
"version": "d3ec10aa95819bff18a0d936b18884c7816d0914",
"versionType": "git"
},
{
"lessThan": "ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d",
"status": "affected",
"version": "d3ec10aa95819bff18a0d936b18884c7816d0914",
"versionType": "git"
},
{
"lessThan": "1486caee47b4909f52835a957c3293e970113e44",
"status": "affected",
"version": "d3ec10aa95819bff18a0d936b18884c7816d0914",
"versionType": "git"
},
{
"lessThan": "ff44f1b303aa76a818d898e85c56ed4852c031e2",
"status": "affected",
"version": "d3ec10aa95819bff18a0d936b18884c7816d0914",
"versionType": "git"
},
{
"lessThan": "6a36e2a1a017c51f8a8ad2a094566bad97c46a9b",
"status": "affected",
"version": "d3ec10aa95819bff18a0d936b18884c7816d0914",
"versionType": "git"
},
{
"lessThan": "3edc064069d07e7d37359fcb4d03d3bab15ee3ab",
"status": "affected",
"version": "d3ec10aa95819bff18a0d936b18884c7816d0914",
"versionType": "git"
},
{
"lessThan": "cf1af7df80e38bf58bd74c2cccce32fcbd1a596a",
"status": "affected",
"version": "d3ec10aa95819bff18a0d936b18884c7816d0914",
"versionType": "git"
},
{
"lessThan": "e2a2deda08d91644f5e30c17d267b1cdc5f124b2",
"status": "affected",
"version": "d3ec10aa95819bff18a0d936b18884c7816d0914",
"versionType": "git"
},
{
"lessThan": "925c84e3cc21caf09de92d9bcafab0147790debf",
"status": "affected",
"version": "d3ec10aa95819bff18a0d936b18884c7816d0914",
"versionType": "git"
},
{
"status": "affected",
"version": "7fa67aa30509ad0da72ac0f757aa76e53c0ea3de",
"versionType": "git"
},
{
"status": "affected",
"version": "18779eac17b5df9dff57138d07631573553a41d4",
"versionType": "git"
},
{
"status": "affected",
"version": "f1afcf9488fc45765e20e2047d3b776981900e0b",
"versionType": "git"
},
{
"status": "affected",
"version": "212d3adb1af4e34acb158d6c6def370016a1011d",
"versionType": "git"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.177",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.118",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.35",
"versionType": "semver"
},
{
"lessThan": "5.7",
"status": "affected",
"version": "5.6.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/keys/keyctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.*",
"status": "unaffected",
"version": "7.3.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.4-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.60",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.14",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3.1",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.4-rc1",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.177",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the read method check against type removal\n\nkeyctl_read_key() checks key->type->read without holding key->sem.\nA reference keeps the key alive, but does not pin the module containing\nits type. A surviving RxRPC key can therefore be read while AF_RXRPC\nis being unloaded:\n\n KEYCTL_READ task Module unload and key GC\n ---------------- ------------------------\n lookup_user_key()\n permission / possession checks\n load key->type\n af_rxrpc_exit()\n unregister_key_type()\n GC: down_write(key->sem)\n GC: retype to key_type_dead\n GC: up_write(key->sem)\n unregister_key_type() returns\n free_module()\n read saved type's read member\n\nThe final access can read freed module storage. The read invocation in\n__keyctl_read_key() is already protected by key->sem, but the earlier\nmethod check is outside that critical section.\n\nMove the method check into __keyctl_read_key(), after key_validate() and\nunder its existing read hold on key->sem. The check and invocation then\nuse the same protected type for length queries and every read retry.\nThe GC cannot retype the key until the semaphore is released, and type\nunregistration waits for that GC pass before the module can be freed.\n\nReturn -EOPNOTSUPP when validation succeeds and the type has no read\nmethod. A temporary buffer may now be allocated before this result;\nallocation and copying to userspace remain outside the semaphore."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T19:12:56.503Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e5f830ae6611cddbfc504c43f14155f60b63206a"
},
{
"url": "https://git.kernel.org/stable/c/ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d"
},
{
"url": "https://git.kernel.org/stable/c/1486caee47b4909f52835a957c3293e970113e44"
},
{
"url": "https://git.kernel.org/stable/c/ff44f1b303aa76a818d898e85c56ed4852c031e2"
},
{
"url": "https://git.kernel.org/stable/c/6a36e2a1a017c51f8a8ad2a094566bad97c46a9b"
},
{
"url": "https://git.kernel.org/stable/c/3edc064069d07e7d37359fcb4d03d3bab15ee3ab"
},
{
"url": "https://git.kernel.org/stable/c/cf1af7df80e38bf58bd74c2cccce32fcbd1a596a"
},
{
"url": "https://git.kernel.org/stable/c/e2a2deda08d91644f5e30c17d267b1cdc5f124b2"
},
{
"url": "https://git.kernel.org/stable/c/925c84e3cc21caf09de92d9bcafab0147790debf"
}
],
"title": "keys: Protect the read method check against type removal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99222",
"datePublished": "2026-11-02T16:06:32.844Z",
"dateReserved": "2026-09-25T10:25:14.402Z",
"dateUpdated": "2026-11-03T19:12:56.503Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}