CVE-2026-63823

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> keys: Pin request_key_auth payload in instantiate paths<br /> <br /> A: request_key() B: KEYCTL_INSTANTIATE_IOV<br /> ================ =========================<br /> <br /> create auth key<br /> store rka in auth key<br /> wait for helper<br /> get auth key<br /> load rka from auth key<br /> copy user payload<br /> sleep on #PF<br /> <br /> helper completed<br /> detach and free rka<br /> destroy auth key<br /> wake up<br /> use rka-&gt;target_key<br /> **USE-AFTER-FREE**<br /> <br /> Give request_key_auth payloads a refcount. Take a payload reference while<br /> authkey-&gt;sem stabilizes the payload and revocation state. Hold that<br /> reference across the instantiate and reject paths. Drop the auth key<br /> owning reference from revoke and destroy.<br /> <br /> [jarkko: Replaced the first two paragraphs of text with an actual<br /> concurrency scenario.]