{"id":25963,"date":"2026-09-18T04:32:09","date_gmt":"2026-09-17T20:32:09","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93106"},"modified":"2026-09-18T04:32:09","modified_gmt":"2026-09-17T20:32:09","slug":"cve-2026-93106","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93106","title":{"rendered":"CVE-2026-93106 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\ncrash_dump: release k"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>crash_dump: release keyring reference at the correct time<\/p>\n<p>restore_dm_crypt_keys_to_thread_keyring() gets a reference to the user<br \/>\nkeyring before restoring the saved dm-crypt keys.<\/p>\n<p>The same keyring reference is then passed to add_key_to_keyring() for each<br \/>\nsaved key, but add_key_to_keyring() drops that reference on every call.<br \/>\nThis is only balanced when exactly one key is restored. With multiple<br \/>\nkeys, the keyring reference is dropped too many times and may trigger a<br \/>\nrefcount underflow or use-after-free.<\/p>\n<p>When more than five keys are restored, a refcount underflow\/use-after-free<br \/>\nwarning can be triggered.<\/p>\n<p>The early error paths after lookup_user_key() also return without dropping<br \/>\nthe keyring reference.<\/p>\n<p>Keep ownership of the keyring reference in<br \/>\nrestore_dm_crypt_keys_to_thread_keyring(), drop it once on all exit paths,<br \/>\nand make add_key_to_keyring() only use the reference without consuming it.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>crash_dump: release keyring reference at the correct time<\/p>\n<p>restore_dm_crypt_keys_to_thread_keyring() gets a reference to the user<br \/>\nk<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25963","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25963","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25963"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25963"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}