{"api_version":"1","generated_at":"2026-11-06T21:28:30+00:00","cve":"CVE-2026-99224","urls":{"html":"https://cve.report/CVE-2026-99224","api":"https://cve.report/api/cve/CVE-2026-99224.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-99224","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-99224"},"summary":{"title":"keys: Protect the type name while describing a key","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the type name while describing a key\n\nkeyctl_describe_key() must keep the key type's name alive until\nkasprintf() has consumed it. The retained key reference keeps the key\nand its description alive, but does not pin the module providing its\ntype. The name is passed to kasprintf() without holding key->sem.\n\nkvasprintf() uses the saved name pointer in two formatting passes, with\na GFP_KERNEL allocation between them. With AF_RXRPC=m, a task that\npasses View permission before type retirement can overlap a privileged\nmodule unload in this order:\n\n1. KEYCTL_DESCRIBE looks up the key, saves key->type->name in the\n   kasprintf() arguments and completes the first formatting pass.\n2. While the formatter is delayed before its second pass,\n   af_rxrpc_exit() calls unregister_key_type(), which removes the type\n   from the registry and waits for key_gc_keytype().\n3. The collector takes key->sem for writing, retypes the retained key\n   to key_type_dead and completes retirement. Unregistration and module\n   exit return, allowing free_module() to release the type and name.\n4. The formatter resumes its second pass and reads the saved name from\n   released module storage, which can fault in string().\n\nHold key->sem for reading across kasprintf(). The collector then cannot\nretype the key or complete retirement until both formatting passes have\nfinished. If retirement wins the lock first, formatting uses the core\nkey_type_dead name instead. Release the semaphore immediately after\nkasprintf(), including on allocation failure, before copying to\nuserspace.\n\nOops report as below:\n\n    BUG: unable to handle page fault for address: fffffbfff8054794\n    #PF: supervisor read access in kernel mode\n    #PF: error_code(0x0000) - not-present page\n    RIP: 0010:string+0x23f/0x470\n    Call Trace:\n     vsnprintf+0x330/0x1110","state":"PUBLISHED","assigner":"Linux","published_at":"2026-11-02 16:17:46","updated_at":"2026-11-03 20:18:27"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/19c4de819e52b7f606468fbfe4fcef4e812e2777","name":"https://git.kernel.org/stable/c/19c4de819e52b7f606468fbfe4fcef4e812e2777","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/fced7238b7e80cf8aa688d5af976e4aa6e33c329","name":"https://git.kernel.org/stable/c/fced7238b7e80cf8aa688d5af976e4aa6e33c329","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6b613747f7ea309ada5b8d05b55398c338f7a968","name":"https://git.kernel.org/stable/c/6b613747f7ea309ada5b8d05b55398c338f7a968","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3c3cfd9e262afc9558c38f8cec57f09d10988546","name":"https://git.kernel.org/stable/c/3c3cfd9e262afc9558c38f8cec57f09d10988546","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/dddd3a1ab7d12ee163477918ff6eb943361db4fe","name":"https://git.kernel.org/stable/c/dddd3a1ab7d12ee163477918ff6eb943361db4fe","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/dea367df18e3a4faac393e3a4e818ee03af89b19","name":"https://git.kernel.org/stable/c/dea367df18e3a4faac393e3a4e818ee03af89b19","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/916667df7695366f23cfaf365b5840b228cc4b2e","name":"https://git.kernel.org/stable/c/916667df7695366f23cfaf365b5840b228cc4b2e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/0461bc8f91116aae4a020e15f4e1c1fd535ab35e","name":"https://git.kernel.org/stable/c/0461bc8f91116aae4a020e15f4e1c1fd535ab35e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a49e6c9a1a5b3457c946a8efb616ce13b4ca8194","name":"https://git.kernel.org/stable/c/a49e6c9a1a5b3457c946a8efb616ce13b4ca8194","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-99224","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99224","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7 19c4de819e52b7f606468fbfe4fcef4e812e2777 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7 a49e6c9a1a5b3457c946a8efb616ce13b4ca8194 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7 916667df7695366f23cfaf365b5840b228cc4b2e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7 dddd3a1ab7d12ee163477918ff6eb943361db4fe git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7 3c3cfd9e262afc9558c38f8cec57f09d10988546 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7 6b613747f7ea309ada5b8d05b55398c338f7a968 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7 dea367df18e3a4faac393e3a4e818ee03af89b19 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7 0461bc8f91116aae4a020e15f4e1c1fd535ab35e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7 fced7238b7e80cf8aa688d5af976e4aa6e33c329 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.18","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 3.18 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.273 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.224 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.191 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.161 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.115 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.60 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.14 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3.1 7.3.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.4-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"99224","cve":"CVE-2026-99224","epss":"0.001140000","percentile":"0.014550000","score_date":"2026-11-03","updated_at":"2026-11-04 00:14:34"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["security/keys/keyctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"19c4de819e52b7f606468fbfe4fcef4e812e2777","status":"affected","version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","versionType":"git"},{"lessThan":"a49e6c9a1a5b3457c946a8efb616ce13b4ca8194","status":"affected","version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","versionType":"git"},{"lessThan":"916667df7695366f23cfaf365b5840b228cc4b2e","status":"affected","version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","versionType":"git"},{"lessThan":"dddd3a1ab7d12ee163477918ff6eb943361db4fe","status":"affected","version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","versionType":"git"},{"lessThan":"3c3cfd9e262afc9558c38f8cec57f09d10988546","status":"affected","version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","versionType":"git"},{"lessThan":"6b613747f7ea309ada5b8d05b55398c338f7a968","status":"affected","version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","versionType":"git"},{"lessThan":"dea367df18e3a4faac393e3a4e818ee03af89b19","status":"affected","version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","versionType":"git"},{"lessThan":"0461bc8f91116aae4a020e15f4e1c1fd535ab35e","status":"affected","version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","versionType":"git"},{"lessThan":"fced7238b7e80cf8aa688d5af976e4aa6e33c329","status":"affected","version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["security/keys/keyctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.18"},{"lessThan":"3.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.273","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.224","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.273","versionStartIncluding":"3.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.224","versionStartIncluding":"3.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.191","versionStartIncluding":"3.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.161","versionStartIncluding":"3.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.115","versionStartIncluding":"3.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.60","versionStartIncluding":"3.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.14","versionStartIncluding":"3.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3.1","versionStartIncluding":"3.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.4-rc1","versionStartIncluding":"3.18","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the type name while describing a key\n\nkeyctl_describe_key() must keep the key type's name alive until\nkasprintf() has consumed it. The retained key reference keeps the key\nand its description alive, but does not pin the module providing its\ntype. The name is passed to kasprintf() without holding key->sem.\n\nkvasprintf() uses the saved name pointer in two formatting passes, with\na GFP_KERNEL allocation between them. With AF_RXRPC=m, a task that\npasses View permission before type retirement can overlap a privileged\nmodule unload in this order:\n\n1. KEYCTL_DESCRIBE looks up the key, saves key->type->name in the\n   kasprintf() arguments and completes the first formatting pass.\n2. While the formatter is delayed before its second pass,\n   af_rxrpc_exit() calls unregister_key_type(), which removes the type\n   from the registry and waits for key_gc_keytype().\n3. The collector takes key->sem for writing, retypes the retained key\n   to key_type_dead and completes retirement. Unregistration and module\n   exit return, allowing free_module() to release the type and name.\n4. The formatter resumes its second pass and reads the saved name from\n   released module storage, which can fault in string().\n\nHold key->sem for reading across kasprintf(). The collector then cannot\nretype the key or complete retirement until both formatting passes have\nfinished. If retirement wins the lock first, formatting uses the core\nkey_type_dead name instead. Release the semaphore immediately after\nkasprintf(), including on allocation failure, before copying to\nuserspace.\n\nOops report as below:\n\n    BUG: unable to handle page fault for address: fffffbfff8054794\n    #PF: supervisor read access in kernel mode\n    #PF: error_code(0x0000) - not-present page\n    RIP: 0010:string+0x23f/0x470\n    Call Trace:\n     vsnprintf+0x330/0x1110"}],"metrics":[{"cvssV3_1":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - Reached from SYSCALL_DEFINE5(keyctl) case KEYCTL_DESCRIBE → keyctl_describe_key(), which passes the in-kernel key->type->name pointer into kasprintf(). The attacker supplies only a key serial via that local syscall; no network protocol carries the type name.\nAC:H - The UAF fires only if unregister_key_type() → key_gc_keytype() (e.g. af_rxrpc_exit) retypes the key and free_module() unmaps the name after keyctl_describe_key() captures key->type->name and before kvasprintf()'s second vsnprintf. delete_module() requires capable(CAP_SYS_MODULE), which this caller cannot get, including in a user namespace.\nPR:L - keyctl_describe_key() uses lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, KEY_NEED_VIEW) with no capable() check. An unprivileged user can add_key(\"rxrpc\", …) with an empty payload (rxrpc_preparse allows datalen==0) into their session keyring and describe it via the default KEY_POS_VIEW|KEY_USR_VIEW bits.\nUI:N - The attacker calls KEYCTL_DESCRIBE on a key they already own. The overlapping admin rmmod/delete_module of the type's module is the AC:H condition, not a victim mount or open of attacker content.\nS:U - The dangling key->type->name read in kvasprintf()/string() and any resulting oops stay inside the host kernel's keyctl path; this does not cross a VM, IOMMU, or sandbox boundary.\nC:H - keyctl_describe_key() copy_to_user()s the kasprintf() buffer that embeds the dangling key->type->name. kvasprintf() walks that pointer in two vsnprintf/string() passes, so after free_module() of af_rxrpc the describe buffer can contain remapped freed module memory, including a large copy if the first pass also races.\nI:H - After key_gc_keytype() retypes the key and free_module() releases af_rxrpc, the captured name pointer aliases freed module pages. Reclaim of those pages lets the attacker control the %s bytes kasprintf() later formats, turning this use-after-free into a kernel write/control-flow primitive per UAF scoring guidance.\nA:H - The reported oops is a supervisor not-present-page fault in string() from vsnprintf() once free_module() has unmapped the type name, which is a kernel oops."}]}],"providerMetadata":{"dateUpdated":"2026-11-03T19:12:57.782Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/19c4de819e52b7f606468fbfe4fcef4e812e2777"},{"url":"https://git.kernel.org/stable/c/a49e6c9a1a5b3457c946a8efb616ce13b4ca8194"},{"url":"https://git.kernel.org/stable/c/916667df7695366f23cfaf365b5840b228cc4b2e"},{"url":"https://git.kernel.org/stable/c/dddd3a1ab7d12ee163477918ff6eb943361db4fe"},{"url":"https://git.kernel.org/stable/c/3c3cfd9e262afc9558c38f8cec57f09d10988546"},{"url":"https://git.kernel.org/stable/c/6b613747f7ea309ada5b8d05b55398c338f7a968"},{"url":"https://git.kernel.org/stable/c/dea367df18e3a4faac393e3a4e818ee03af89b19"},{"url":"https://git.kernel.org/stable/c/0461bc8f91116aae4a020e15f4e1c1fd535ab35e"},{"url":"https://git.kernel.org/stable/c/fced7238b7e80cf8aa688d5af976e4aa6e33c329"}],"title":"keys: Protect the type name while describing a key","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99224","datePublished":"2026-11-02T16:06:34.014Z","dateReserved":"2026-09-25T10:25:14.402Z","dateUpdated":"2026-11-03T19:12:57.782Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-02 16:17:46","lastModifiedDate":"2026-11-03 20:18:27","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"99224","Ordinal":"1","Title":"keys: Protect the type name while describing a key","CVE":"CVE-2026-99224","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"99224","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the type name while describing a key\n\nkeyctl_describe_key() must keep the key type's name alive until\nkasprintf() has consumed it. The retained key reference keeps the key\nand its description alive, but does not pin the module providing its\ntype. The name is passed to kasprintf() without holding key->sem.\n\nkvasprintf() uses the saved name pointer in two formatting passes, with\na GFP_KERNEL allocation between them. With AF_RXRPC=m, a task that\npasses View permission before type retirement can overlap a privileged\nmodule unload in this order:\n\n1. KEYCTL_DESCRIBE looks up the key, saves key->type->name in the\n   kasprintf() arguments and completes the first formatting pass.\n2. While the formatter is delayed before its second pass,\n   af_rxrpc_exit() calls unregister_key_type(), which removes the type\n   from the registry and waits for key_gc_keytype().\n3. The collector takes key->sem for writing, retypes the retained key\n   to key_type_dead and completes retirement. Unregistration and module\n   exit return, allowing free_module() to release the type and name.\n4. The formatter resumes its second pass and reads the saved name from\n   released module storage, which can fault in string().\n\nHold key->sem for reading across kasprintf(). The collector then cannot\nretype the key or complete retirement until both formatting passes have\nfinished. If retirement wins the lock first, formatting uses the core\nkey_type_dead name instead. Release the semaphore immediately after\nkasprintf(), including on allocation failure, before copying to\nuserspace.\n\nOops report as below:\n\n    BUG: unable to handle page fault for address: fffffbfff8054794\n    #PF: supervisor read access in kernel mode\n    #PF: error_code(0x0000) - not-present page\n    RIP: 0010:string+0x23f/0x470\n    Call Trace:\n     vsnprintf+0x330/0x1110","Type":"Description","Title":"keys: Protect the type name while describing a key"}]}}}