{"id":"EM-20261102-EJD2","url":"https://cyber.eventmonitor.net/incident/EM-20261102-EJD2/","type":"cve","title":"Linux Kernel Vulnerability (CVE-2026-99224)","subtitle":"CVE-2026-99224","subject":"CVE-2026-99224","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-02T16:17:46.830Z","firstSignal":"2026-11-02T16:06:34.000Z","lastSignal":"2026-11-02T16:17:46.830Z","updated":"2026-11-04T14:43:58.877Z","revision":1,"life":[{"status":"Born","at":"2026-11-02T16:17:46.830Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-02T16:17:46.830Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-02T16:06:34.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-02T16:17:46.830Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261102-EJD2 created."},{"at":"2026-11-02T16:17:46.830Z","what":"Severity raised to High by C6"}],"stages":[{"name":"Disclosed","at":"2026-11-02T16:17:46.830Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-02T16:17:46.830Z","detail":"CVSS 7 · EPSS 0.1%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-02T16:06:34.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-02T16:06:34.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":2,"title":"Red Hat: CVE-2026-99224 (moderate)","text":"kernel: kernel: Denial of Service via use-after-free in keyctl_describe_key","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-99224.json"},{"at":"2026-11-02T16:17:46.830Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-99224 (CVSS 7)","text":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the type name while describing a key\n\nkeyctl_describe_key() must keep the key type's name alive until\nkasprintf() has consumed it. The retained key reference keeps the key\nand its description alive, but does not pin the module providing its\ntype. The name is passed to kasprintf() without holding key->sem.\n\nkvasprintf() uses the saved name pointer in two formatting passes, with\na GFP_KERNEL allocation between them. With AF_RXRPC=m, a task that\npasses View permission before type retirement can overlap a privileged","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99224"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-02T16:17:46.830","score":7,"severity":"HIGH","desc":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the type name while describing a key\n\nkeyctl_describe_key() must keep the key type's name alive until\nkasprintf() has consumed it. The retained key reference keeps the key\nand its description alive, but does not pin t","product":"","seen":1793803438877},"kev":null,"epss":{"epss":0.00119,"pct":0.01757,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}