Bug 2502380 (CVE-2026-64015)

Summary: CVE-2026-64015 kernel: security/keys: fix missed RCU read section on lookup
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's keyring code. The `assoc_array_find()` function, used for looking up keys, was called without holding the necessary Read-Copy-Update (RCU) read lock. This oversight allows for a memory corruption vulnerability, particularly affecting persistent key handling, as the system's garbage collection mechanism can free memory while it is still in use. This could lead to a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-19 16:04:56 UTC 
In the Linux kernel, the following vulnerability has been resolved:

security/keys: fix missed RCU read section on lookup

Nicholas Carlini reports that the keyring code calls assoc_array_find()
in find_key_to_update() without holding the RCU read lock, while the
assoc_array_gc() code really is designed around removing the node from
the tree and then freeing it after an RCU grace-period.

The regular key handling doesn't see this because holding the keyring
semaphore hides any lifetime issues, but the persistent key handling
uses a different model.

Instead of extending the keyring locking, just do the simple RCU locking
that the assoc_array was designed for.
Comment 1 Keith Grant 2026-07-22 00:28:41 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026071957-CVE-2026-64015-19c9@gregkh/T
Comment 3 errata-xmlrpc 2026-09-08 11:35:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:65334 https://access.redhat.com/errata/RHSA-2026:65334
Comment 4 errata-xmlrpc 2026-09-10 05:18:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:66324 https://access.redhat.com/errata/RHSA-2026:66324
Comment 5 errata-xmlrpc 2026-09-10 05:40:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:66325 https://access.redhat.com/errata/RHSA-2026:66325
Comment 6 Jon Orris 2026-09-15 06:28:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:67470 https://access.redhat.com/errata/RHSA-2026:67470