CVE-2026-89608

Received Received - Intake

ecryptfs Packet Parsing Buffer Size Validation Flaw

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfs_parse_packet_set() receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGE_SIZE - 8. For version 1 headers the packet set starts later in the header, so this can overstate the available buffer. Pass the actual packet set buffer length from the caller and calculate per-packet limits from the remaining bytes in that buffer. Recompute the remaining length after consuming a tag 3 packet before parsing the following tag 11 packet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89608

EUVD

EUVD-2026-76520

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's ecryptfs file encryption system. It involves incorrect calculation of the available buffer size when parsing encrypted file headers. The function ecryptfs_parse_packet_set() uses PAGE_SIZE - 8 to estimate buffer space, but for version 1 headers, the packet set starts later, leading to potential overestimation of available space. This could allow buffer overflows or parsing errors.

Detection Guidance

This vulnerability is specific to the Linux kernel's ecryptfs filesystem and requires examining kernel code or running specific filesystem checks. No standard network or system commands directly detect this issue. Review kernel logs for ecryptfs-related errors or inspect the kernel version for affected code paths.

Impact Analysis

If exploited, this flaw could allow an attacker to cause memory corruption, crashes, or unexpected behavior in the kernel. On systems using ecryptfs for file encryption, it might lead to data corruption, denial of service, or unauthorized access to encrypted data. Users relying on ecryptfs for secure storage could face security risks.

Compliance Impact

This vulnerability could impact compliance with data protection regulations like GDPR or HIPAA by compromising the integrity and confidentiality of encrypted data. If encrypted data is corrupted or exposed due to this flaw, organizations may fail to meet requirements for secure data handling, potentially leading to legal or regulatory penalties.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. If patches are unavailable, consider disabling ecryptfs if not in use. Monitor vendor advisories for updates and test patches in a non-production environment before deployment.

Hi! I’m here to help you understand CVE-2026-89608. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70