CVE-2026-99040

In the Linux kernel, the following vulnerability has been resolved:

KEYS: Fix add key() race with keyring restriction

key create or update() snapshots keyring->restrict link before taking the destination keyring's semaphore. keyring restrict() installs a restriction while holding that semaphore.

This allows a writer to observe no restriction, wait for the keyring owner to install a reject-all restriction and return successfully, and then link a key using the stale NULL snapshot. The writer only needs write permission on the destination keyring.

Move the restrict link read after key link lock() and key link begin(). The read and the subsequent restriction check are then serialized with restriction installation by keyring->sem.

The race was reproduced on v7.2.8 in 19 executions where restriction installation returned before the link completed. All 19 linked the key despite the reject-all restriction. With this change, 312 executions reached the same ordering and every add key() call failed with -EPERM.

The issue was found by manual concurrency analysis assisted by AI-based analysis and independently verified with a QEMU reproducer and kernel instrumentation.