PT-2026-90323 · Linux · Linux
CVE-2026-89607
·
Published
2026-09-11
·
Updated
2026-09-11
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
ecryptfs: reject oversized encrypted key size in parse tag 3 packet
parse tag 3 packet() set encrypted key size from the Tag 3 packet body
without bounding it against ECRYPTFS MAX KEY BYTES (64). When
encrypted key size > 64, decrypt passphrase encrypted session key()
sets decrypted key size = encrypted key size and performs two
out-of-bounds writes:
- crypto skcipher decrypt() writes encrypted key size bytes into decrypted key[64] via scatterlist, overflowing into the parent ecryptfs auth tok struct.
- memcpy(crypt stat->key, decrypted key, decrypted key size) writes into crypt stat->key[64], corrupting root iv, keysig list, and mutexes in ecryptfs crypt stat.
Only AES-192 (cipher code 0x08) enables this because it sets
crypt stat->key size = 24 independently of encrypted key size,
allowing crypto skcipher setkey() to succeed while encrypted key size
exceeds ECRYPTFS MAX KEY BYTES.
The PKI decryption path (parse tag 65 packet) already validates
decrypted key size <= ECRYPTFS MAX KEY BYTES; the passphrase path
omits this check.
Bound encrypted key size against ECRYPTFS MAX KEY BYTES (64) rather
than ECRYPTFS MAX ENCRYPTED KEY BYTES (512). The 64-byte limit also
protects the 512-byte encrypted key[] buffer, so the former 512-byte
check is removed as redundant.
[tyhicks: Adjust the code comment to refer to macros representing the
buffer sizes rather than mentioning the buffer size values since they
may change in the future]
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux