It was found that it is possible for root to gain direct access to an internal keyring, such as '.builtin_trusted_keys' upstream, by joining it as its session keyring. This allows root to bypass module signature verification by adding a new public key of its own devising to the keyring. https://nvd.nist.gov/vuln/detail/CVE-2016-9604
