CVE-2026-99220

In the Linux kernel, the following vulnerability has been resolved:

asymmetric keys: reject trust keys without IDs

The PKCS#8 parser deliberately leaves the asym key ids payload slot empty. key or keyring common() unconditionally dereferences that slot when a PKCS#8 key is supplied to a key or keyring restriction. Both the plain and :chain forms reach this branch, allowing an unprivileged caller to trigger a NULL pointer dereference through KEYCTL RESTRICT KEYRING followed by add key().

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:key or keyring common (crypto/asymmetric keys/restrict.c:205 crypto/asymmetric keys/restrict.c:279) Call Trace: key create or update (security/keys/key.c:884) key create or update (security/keys/key.c:1021) do sys add key (security/keys/keyctl.c:134) do syscall 64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entry SYSCALL 64 after hwframe (arch/x86/entry/entry 64.S:130) Kernel panic - not syncing: Fatal exception

Reject an asymmetric restriction key without key IDs. A PKCS#8 private key cannot identify the signer of a candidate certificate and is not a valid trust anchor.