CVE-2026-89607

Received Received - Intake

Heap Overflow in Linux Kernel ecryptfs

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet parse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body without bounding it against ECRYPTFS_MAX_KEY_BYTES (64). When encrypted_key_size > 64, decrypt_passphrase_encrypted_session_key() sets decrypted_key_size = encrypted_key_size and performs two out-of-bounds writes: 1. crypto_skcipher_decrypt() writes encrypted_key_size bytes into decrypted_key[64] via scatterlist, overflowing into the parent ecryptfs_auth_tok struct. 2. memcpy(crypt_stat->key, decrypted_key, decrypted_key_size) writes into crypt_stat->key[64], corrupting root_iv, keysig_list, and mutexes in ecryptfs_crypt_stat. Only AES-192 (cipher code 0x08) enables this because it sets crypt_stat->key_size = 24 independently of encrypted_key_size, allowing crypto_skcipher_setkey() to succeed while encrypted_key_size exceeds ECRYPTFS_MAX_KEY_BYTES. The PKI decryption path (parse_tag_65_packet) already validates decrypted_key_size <= ECRYPTFS_MAX_KEY_BYTES; the passphrase path omits this check. Bound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64) rather than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES (512). The 64-byte limit also protects the 512-byte encrypted_key[] buffer, so the former 512-byte check is removed as redundant. [tyhicks: Adjust the code comment to refer to macros representing the buffer sizes rather than mentioning the buffer size values since they may change in the future]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89607

EUVD

EUVD-2026-76519

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	ecryptfs	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel's ecryptfs encryption system allows out-of-bounds memory writes when processing oversized encrypted key sizes. The function parse_tag_3_packet does not validate the encrypted_key_size against the maximum allowed size of 64 bytes. When this size exceeds 64, it triggers two buffer overflows that corrupt adjacent memory structures, including cryptographic keys and mutexes.

Detection Guidance

This vulnerability is specific to the Linux kernel's ecryptfs module and requires local system access to detect. Check if your kernel version includes the vulnerable code by running: uname -a. If your system uses ecryptfs for encryption, inspect the kernel logs for out-of-bounds write errors or crashes related to ecryptfs.

Impact Analysis

This vulnerability could allow an attacker to corrupt kernel memory, potentially leading to system crashes, privilege escalation, or unauthorized access. If exploited, it may compromise the integrity of encrypted data or enable arbitrary code execution on affected systems running ecryptfs with AES-192 encryption.

Mitigation Strategies

Update your Linux kernel to the latest patched version that includes the fix for this CVE. If updating is not immediately possible, disable the ecryptfs module by running: sudo modprobe -r ecryptfs. Avoid using ecryptfs for encryption until the patch is applied.

Hi! I’m here to help you understand CVE-2026-89607. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70