CVE-2026-63823

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

keys: Pin request_key_auth payload in instantiate paths

A: request_key() B: KEYCTL_INSTANTIATE_IOV

================ =========================

create auth key

store rka in auth key

wait for helper

get auth key

load rka from auth key

copy user payload

sleep on #PF

helper completed

detach and free rka

destroy auth key

wake up

use rka->target_key

**USE-AFTER-FREE**

Give request_key_auth payloads a refcount. Take a payload reference while

authkey->sem stabilizes the payload and revocation state. Hold that

reference across the instantiate and reject paths. Drop the auth key

owning reference from revoke and destroy.

[jarkko: Replaced the first two paragraphs of text with an actual

concurrency scenario.]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References