CVE-2026-89607
nicheOut-of-bounds kernel writes in Linux eCryptfs Tag 3 session-key parsing
The Linux kernel's eCryptfs stacked cryptographic filesystem fails to bound the encrypted_key_size field from a Tag 3 (passphrase) packet against ECRYPTFS_MAX_KEY_BYTES (64) in parse_tag_3_packet(). A local attacker who can supply a crafted eCryptfs authentication-token file — with an oversized encrypted_key_size and cipher code 0x08 (AES-192, which lets crypto_skcipher_setkey succeed regardless) — triggers two out-of-bounds writes during session-key decryption: a scatterlist write past decrypted_key[64] into the parent ecryptfs_auth_tok struct, and a memcpy past crypt_stat->key[64] that corrupts root_iv, keysig_list, and mutexes in ecryptfs_crypt_stat. Successful exploitation yields kernel memory corruption that can crash the machine or plausibly escalate local privileges (CVSS 3.1: 7.8, AV:L/AC:L/PR:L, C:H/I:H/A:H). Any system running a kernel with eCryptfs enabled that processes attacker-controlled passphrase-protected eCryptfs token files — e.g., multi-user hosts where untrusted users can mount eCryptfs filesystems — is affected. No public proof of concept exists and no exploitation in the wild has been reported.
What to do: Update to a kernel release containing the parse_tag_3_packet fix (check your distribution's kernel package advisories for this CVE). If the ecryptfs module is unused, blacklist or unload it to eliminate the code path entirely; otherwise restrict untrusted local users from mounting eCryptfs filesystems or supplying auth-token files. On multi-user systems still using eCryptfs (notably legacy encrypted-home deployments), audit which accounts hold CAP_SYS_ADMIN/mount capability.
| Linux kernel (eCryptfs) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet parse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body without bounding it against ECRYPTFS_MAX_KEY_BYTES (64). When encrypted_key_size > 64, decrypt_passphrase_encrypted_session_key() sets decrypted_key_size = encrypted_key_size and performs two out-of-bounds writes: 1. crypto_skcipher_decrypt() writes encrypted_key_size bytes into decrypted_key[64] via scatterlist, overflowing into the parent ecryptfs_auth_tok struct. 2. memcpy(crypt_stat->key, decrypted_key, decrypted_key_size) writes into crypt_stat->key[64], corrupting root_iv, keysig_list, and mutexes in ecryptfs_crypt_stat. Only AES-192 (cipher code 0x08) enables this because it sets crypt_stat->key_size = 24 independently of encrypted_key_size, allowing crypto_skcipher_setkey() to succeed while encrypted_key_size exceeds ECRYPTFS_MAX_KEY_BYTES. The PKI decryption path (parse_tag_65_packet) already validates decrypted_key_size <= ECRYPTFS_MAX_KEY_BYTES; the passphrase path omits this check. Bound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64) rather than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES (512). The 64-byte limit also protects the 512-byte encrypted_key[] buffer, so the former 512-byte check is removed as redundant. [tyhicks: Adjust the code comment to refer to macros representing the buffer sizes rather than mentioning the buffer size values since they may change in the future]
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.