Linux Kernel EUVD-2026-45489

The flaw lives in the Linux kernel keyrings/keyctl subsystem, specifically the request_key_auth key type used to authorize a userspace upcall (request-key helper) to instantiate a pending key. When request_key() creates an authorization ('auth') key, it stores a request_key_auth payload (rka) that references the target key being instantiated. A second thread using KEYCTL_INSTANTIATE_IOV loads that rka and copies a user-supplied payload; if it sleeps on a page fault while copying, the helper-completion path on the first thread can revoke/destroy the auth key and free the rka out from under the second thread, which then uses the dangling rka->target_key pointer. This is a classic use-after-free (CWE-416) rooted in a missing lifetime/refcount guarantee on the payload; the fix adds a refcount to request_key_auth payloads, takes a reference under authkey->sem across the instantiate and reject paths, and moves the owning-reference drop into the revoke/destroy paths. The CPE data identifies the affected product as the Linux kernel (cpe:2.3:a:linux:linux:*), and the CWE was reported as N/A by the source but maps cleanly to use-after-free.