CVE-2026-74567

Summary

In the Linux kernel, the following vulnerability has been resolved:

keys: fix out-of-bounds read in keyring_get_key_chunk()

For description-level chunks keyring_get_key_chunk() advances the read pointer by level * sizeof(long) past the inline prefix but only bounds-checks the prefix, so a long enough key description is read past its kmemdup(desc, desc_len + 1) allocation. Compute the full byte offset and bounds-check the description against it before reading.

The walk only reaches a description-level chunk when two keys collide through the hash, x, type and domain_tag chunks, so this is reached from an unprivileged add_key(2) with a crafted pair of same-type keys whose index hashes collide; KASAN reports a slab-out-of-bounds read.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxf771fde82051976a6fc0fd570f8b86de4a92124b < 4c0c26f751e50d3027eacc4d7d0fabc31f1d7e6baffected
LinuxLinuxf771fde82051976a6fc0fd570f8b86de4a92124b < 79916f40d4ab1b4ae694d8c024fd179454bfe46eaffected
LinuxLinuxf771fde82051976a6fc0fd570f8b86de4a92124b < e5b01998cef8d7f613200230ccaadebe5de9135caffected
LinuxLinuxf771fde82051976a6fc0fd570f8b86de4a92124b < d1933e03e8c74a018550c31a393b79c4d95bff40affected
LinuxLinuxf771fde82051976a6fc0fd570f8b86de4a92124b < 3a744838453fb9309ce5a5526d3252e211d60152affected
LinuxLinuxf771fde82051976a6fc0fd570f8b86de4a92124b < e9417d21a22ad2ec398e78fcf084b717ce92cf2faffected
LinuxLinuxf771fde82051976a6fc0fd570f8b86de4a92124b < 8dba33c1e779d0fb9a2acb31e354cf0fc0229111affected
LinuxLinuxf771fde82051976a6fc0fd570f8b86de4a92124b < 63918731f9ae25b5deb022f118e941e6dddfcef4affected
LinuxLinux5.3affected
LinuxLinux0 < 5.3unaffected
LinuxLinux5.10.265 <= 5.10.*unaffected
LinuxLinux5.15.216 <= 5.15.*unaffected
LinuxLinux6.1.183 <= 6.1.*unaffected
LinuxLinux6.6.151 <= 6.6.*unaffected
LinuxLinux6.12.103 <= 6.12.*unaffected
LinuxLinux6.18.44 <= 6.18.*unaffected
LinuxLinux7.1.8 <= 7.1.*unaffected
LinuxLinux7.2 <= *unaffected

Weaknesses

References