[PATCH] keys: Fix key_user use-after-free during ownership changes

[Chengfeng Ye]

On Fri, Aug 28, 2026 at 6:06 AM Jarkko Sakkinen <jarkko at kernel.org> wrote:
>
> I hope you don't mind that I sanity check a bit:
>
>  git grep "user->uid" security/keys
> security/keys/internal.h:       uid = key->user->uid;
> security/keys/key.c:            if (uid_lt(uid, user->uid))
> security/keys/key.c:            else if (uid_gt(uid, user->uid))
> security/keys/key.c:            unsigned maxbytes = uid_eq(key->user->uid, GLOBAL_ROOT_UID) ?
> security/keys/proc.c:           if (kuid_has_mapping(user_ns, user->uid))
> security/keys/proc.c:   unsigned maxkeys = uid_eq(user->uid, GLOBAL_ROOT_UID) ?
> security/keys/proc.c:   unsigned maxbytes = uid_eq(user->uid, GLOBAL_ROOT_UID) ?
> security/keys/proc.c:              from_kuid_munged(seq_user_ns(m), user->uid),
> security/keys/process_keys.c:   uid_t uid = from_kuid(user_ns, cred->user->uid);
> security/keys/process_keys.c:           uid_keyring = keyring_alloc(buf, cred->user->uid, INVALID_GID,
> security/keys/process_keys.c:           session_keyring = keyring_alloc(buf, cred->user->uid, INVALID_GID,
> security/keys/process_keys.c:                                               cred->user->uid));
>
> Have you audited these and reflected against your current patch?
>
> BR, Jarkko
>

Right, there are more sites that take and dereference key->user but
not serialized to prevent the UAF. I am going to send a v2 to protect
other sites affected by the data race.

Best regards,
Chengfeng