CVE-2026-74566

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

keys: make keyring key-chunk byte order agree with keyring_diff_objects()

keyring_get_key_chunk() loads description bytes into the index chunk low

address first, while keyring_diff_objects() numbers the first differing

bit from the low end and folds the absolute byte index into the level

without removing the inline-prefix offset the level already carries.

The two disagree on byte order and bit position, so the array can be

told two keys first differ at a bit that does not differ in the chunk

the walker uses, letting crafted descriptions collide into one node.

Load the chunk in the order keyring_diff_objects() assumes and drop the

inline-prefix length when folding the byte index into the level. This

only changes the in-memory ordering used to place keys within a keyring;

add, search and read of non-colliding keys are unaffected.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References