CVE-2026-99245

In the Linux kernel, the following vulnerability has been resolved:

KEYS: Fix key reject and link() race with keyring restriction

The restrict link check in key reject and link() is done before taking the keyring semaphore, racing with a concurrent keyring restrict() that installs the restriction while holding the semaphore in write mode.

Move the check to after key link lock(), so it is done under the semaphore, matching the pattern used in key create or update().