CVE-2026-89608

The Linux kernel's eCryptfs subsystem contains an out-of-bounds read in ecryptfs_parse_packet_set(), which computed the remaining packet-buffer size from PAGE_SIZE - 8 instead of the actual buffer length; because version 1 headers start the packet set later in the file header, the parser could overstate the available space and read past the end of the buffer when consuming tag 3 and tag 11 packets. A local attacker triggers the flaw by supplying a crafted eCryptfs file header that the kernel parses, for example when an eCryptfs filesystem is mounted or a file within one (such as a file in an eCryptfs-encrypted home directory) is opened. Successful exploitation can disclose kernel memory or crash the kernel, causing a denial of service, and requires only an unprivileged local account (AV:L/PR:L). Affected systems are Linux installations that use the eCryptfs stacked cryptographic filesystem, historically common for encrypted home directories on distributions such as Ubuntu. There is no known public proof of concept, the issue is not in CISA's KEV, and no exploitation in the wild has been reported.

What to do: Apply your distribution's patched kernel once it includes this fix and reboot. If eCryptfs is not needed, prevent the module from loading (it typically loads only when an eCryptfs mount exists) and plan migration of encrypted home directories to LUKS or fscrypt. Watch for kernel oopses or panics during eCryptfs mounts, which could indicate crafted file headers being parsed.