bpf_lookup_user_key(9)

💖 bpf_lookup_user_key — Kernel API Manual, section 9 🎀

okay so bestie, welcome to the glow-up of bpf_lookup_user_key(9) — yes that's the section 9 manual page, we're in kernel API territory now, put your hair up 💅

---

✨ NAME ✨

bpf_lookup_user_key — lookup a key by its serial 🔑

---

✨ SYNOPSIS ✨

__bpf_kfunc struct bpf_key * bpf_lookup_user_key (s32 serial , u64 flags
);

bestie look at that signature. __bpf_kfunc, returns a struct bpf_key *, takes an s32 serial and a u64 flags. slay. it's giving "I know exactly what I'm doing" energy fr fr 🫶

---

✨ ARGUMENTS ✨

• serial — the key handle serial number. like the key's little ID card 🪪
• flags — the lookup-specific flags. the vibe check knobs, basically 🎛️

---

✨ DESCRIPTION ✨

So what does it do? It searches for a key with the given serial and the provided flags. If it finds it, it increments the reference count of the key by one, and returns it inside the bpf_key structure. literally a whole "found you bestie, you're mine now" moment 💖

The bpf_key structure must be passed to bpf_key_put when you're done with it, so that the key reference count gets decremented and the bpf_key structure is freed. no leaving it on read, no ghosting your refcounts, that's not iconic behaviour 🙈

Permission checks? Those are deferred to the time the key is actually used by one of the available key-specific kfuncs. so don't come for this function about permissions, it's a later-episode plot point ✨

Now, the flags, pay attention bestie:

• Set flags with KEY_LOOKUP_CREATE to attempt creating a requested special keyring (e.g. session keyring) if it doesn't yet exist. like, manifesting the keyring into existence 🧚
• Set flags with KEY_LOOKUP_PARTIAL to lookup a key without waiting for the key construction, and to retrieve uninstantiated keys (keys without data attached to them). yes, half-baked keys count, we don't judge 💀

---

✨ RETURN ✨

Returns a bpf_key pointer with a valid key pointer if the key is found — and a NULL pointer otherwise. so like, found = iconic, not found = NULL, no in-between, no crumbs 🌸

---

✨ SEE ALSO ✨

okay this list is long, but every single one of them is a baddie and we're listing them all, no cap 👑

Kernel file ./kernel/bpf/helpers.c

bpf_obj_new(9), bpf_percpu_obj_new(9), bpf_obj_drop(9), bpf_percpu_obj_drop(9), bpf_refcount_acquire(9), bpf_list_push_front(9), bpf_list_push_back(9), bpf_rbtree_add(9), bpf_task_acquire(9), bpf_task_release(9), bpf_cgroup_acquire(9), bpf_cgroup_release(9), bpf_cgroup_ancestor(9), bpf_cgroup_from_id(9), bpf_task_under_cgroup(9), bpf_task_get_cgroup1(9), bpf_task_from_pid(9), bpf_task_from_vpid(9), bpf_dynptr_slice(9), bpf_dynptr_slice_rdwr(9), bpf_dynptr_copy(9), bpf_dynptr_memset(9), bpf_iter_bits_new(9), bpf_iter_bits_next(9), bpf_iter_bits_destroy(9), bpf_copy_from_user_str(9), bpf_copy_from_user_task_str(9), bpf_strcmp(9), bpf_strcasecmp(9), bpf_strnchr(9), bpf_strchr(9), bpf_strchrnul(9), bpf_strrchr(9), bpf_strnlen(9), bpf_strlen(9), bpf_strspn(9), bpf_strcspn(9), bpf_strstr(9), bpf_strcasestr(9), bpf_strnstr(9), bpf_strncasestr(9), bpf_lookup_system_key(9), bpf_key_put(9), bpf_verify_pkcs7_signature(9), bpf_task_work_schedule_signal(9), bpf_task_work_schedule_resume(9), bpf_timer_cancel_async(9)

---

quick reminder bestie: bpf_key_put is right there in SEE ALSO for a reason. use it. free your bpf_key. be responsible with your refcounts 💅

---

and that's the page! this little drop came from ./kernel/bpf, dated October 2026 — mwah, bookmark it, screenshot it, send it to the group chat 🦋💜 ✨