The join_session_keyring function in security/keys/process_keys.c in the
Linux kernel before 4.4.1 mishandles object references in a certain error
case, which allows local users to gain privileges or cause a denial of
service (integer overflow and use-after-free) via crafted keyctl commands.

Yevgeny Pats discovered that the session keyring implementation in the
Linux kernel did not properly reference count when joining an existing
session keyring. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code with
administrative privileges.