CVE-2026-89606

The Linux kernel's eCryptfs stacked cryptographic filesystem contains an integer underflow in ecryptfs_parse_tag_70_packet(), which derives the encrypted filename size by subtracting fixed metadata fields from the parsed packet body size. A locally privileged attacker can trigger the flaw by supplying a malformed tag 70 packet (used for encrypted filenames) whose body is smaller than the fixed signature and cipher-code fields, causing the size calculation to wrap around. Successful exploitation can lead to kernel memory corruption (out-of-bounds access) with high impact on confidentiality, integrity, and availability, most plausibly a local privilege escalation or kernel crash. Only systems actually using eCryptfs filesystems (such as legacy Ubuntu encrypted-home setups) with untrusted local users are exposed; the flaw is not remotely triggerable and there is no evidence of exploitation in the wild.

What to do: Apply kernel updates containing the upstream eCryptfs fix once your distribution ships it; no fixed version numbers were specified in the source data. If eCryptfs is not needed, blacklist the ecryptfs module to eliminate the attack surface entirely. Audit for exposure by checking for eCryptfs mounts (mount | grep ecryptfs) or ~/.ecryptfs / /home/.ecryptfs directories, and restrict untrusted local accounts on hosts where eCryptfs remains in use.