Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-74567

keys: fix out-of-bounds read in keyring_get_key_chunk()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyring_get_key_chunk() For description-level chunks keyring_get_key_chunk() advances the read pointer by level * sizeof(long) past the inline prefix but only bounds-checks the prefix, so a long enough key description is read past its kmemdup(desc, desc_len + 1) allocation. Compute the full byte offset and bounds-check the description against it before reading. The walk only reaches a description-level chunk when two keys collide through the hash, x, type and domain_tag chunks, so this is reached from an unprivileged add_key(2) with a crafted pair of same-type keys whose index hashes collide; KASAN reports a slab-out-of-bounds read.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From f771fde82051976a6fc0fd570f8b86de4a92124b · fixed in 4c0c26f751e50d3027eacc4d7d0fabc31f1d7e6b; From f771fde82051976a6fc0fd570f8b86de4a92124b · fixed in 79916f40d4ab1b4ae694d8c024fd179454bfe46e; From f771fde82051976a6fc0fd570f8b86de4a92124b · fixed in e5b01998cef8d7f613200230ccaadebe5de9135c; From f771fde82051976a6fc0fd570f8b86de4a92124b · fixed in d1933e03e8c74a018550c31a393b79c4d95bff40; From f771fde82051976a6fc0fd570f8b86de4a92124b · fixed in 3a744838453fb9309ce5a5526d3252e211d60152; From f771fde82051976a6fc0fd570f8b86de4a92124b · fixed in e9417d21a22ad2ec398e78fcf084b717ce92cf2f; From f771fde82051976a6fc0fd570f8b86de4a92124b · fixed in 8dba33c1e779d0fb9a2acb31e354cf0fc0229111; From f771fde82051976a6fc0fd570f8b86de4a92124b · fixed in 63918731f9ae25b5deb022f118e941e6dddfcef4

  • Linux Linux

    5.3

  • KernelLinux

    From 5.3.0 · fixed in 5.10.265; From 5.11.0 · fixed in 5.15.216; From 5.16.0 · fixed in 6.1.183; From 6.2.0 · fixed in 6.6.151; From 6.7.0 · fixed in 6.12.103; From 6.13.0 · fixed in 6.18.44; From 6.19.0 · fixed in 7.1.8

References 8

git.kernel.org