---
name: "KEYCTL_INVALIDATE"
section: "2const"
platform: "linux"
package: "man-pages"
version: "6.19-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/KEYCTL_INVALIDATE"
---

# KEYCTL\_INVALIDATE(2const)

invalidate a key

## NAME

KEYCTL\_INVALIDATE - invalidate a key

## LIBRARY

Standard C library (*libc*, *-lc*)

## SYNOPSIS

```
#include <linux/keyctl.h>  /* Definition of KEY* constants */
#include <sys/syscall.h>   /* Definition of SYS_* constants */
#include <unistd.h>
```

**long syscall(SYS\_keyctl, KEYCTL\_INVALIDATE, key\_serial\_t** *key***);**

## DESCRIPTION

Mark a key as invalid.

The ID of the key to be invalidated is specified in *key*.

To invalidate a key, the caller must have *search* permission on the key.

This operation marks the key as invalid and schedules immediate garbage collection. The garbage collector removes the invalidated key from all keyrings and deletes the key when its reference count reaches zero. After this operation, the key will be ignored by all searches, even if it is not yet deleted.

Keys that are marked invalid become invisible to normal key operations immediately, though they are still visible in */proc/keys* (marked with an 'i' flag) until they are actually removed.

## RETURN VALUE

On success, 0 is returned.

On error, -1 is returned, and *errno* is set to indicate the error.

## VERSIONS

A wrapper is provided in the *libkeyutils* library: [**keyctl\_invalidate**(3)](/keyctl_invalidate/3.md).

## STANDARDS

Linux.

## HISTORY

Linux 3.5.

## SEE ALSO

[**keyctl**(2)](/keyctl/2.md), [**keyctl\_invalidate**(3)](/keyctl_invalidate/3.md)