CVE-2026-93106

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

crash_dump: release keyring reference at the correct time

restore_dm_crypt_keys_to_thread_keyring() gets a reference to the user

keyring before restoring the saved dm-crypt keys.

The same keyring reference is then passed to add_key_to_keyring() for each

saved key, but add_key_to_keyring() drops that reference on every call.

This is only balanced when exactly one key is restored. With multiple

keys, the keyring reference is dropped too many times and may trigger a

refcount underflow or use-after-free.

When more than five keys are restored, a refcount underflow/use-after-free

warning can be triggered.

The early error paths after lookup_user_key() also return without dropping

the keyring reference.

Keep ownership of the keyring reference in

restore_dm_crypt_keys_to_thread_keyring(), drop it once on all exit paths,

and make add_key_to_keyring() only use the reference without consuming it.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References