CVE-2026-89607

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet

parse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body

without bounding it against ECRYPTFS_MAX_KEY_BYTES (64). When

encrypted_key_size > 64, decrypt_passphrase_encrypted_session_key()

sets decrypted_key_size = encrypted_key_size and performs two

out-of-bounds writes:

1. crypto_skcipher_decrypt() writes encrypted_key_size bytes into

decrypted_key[64] via scatterlist, overflowing into the parent

ecryptfs_auth_tok struct.

2. memcpy(crypt_stat->key, decrypted_key, decrypted_key_size) writes

into crypt_stat->key[64], corrupting root_iv, keysig_list, and

mutexes in ecryptfs_crypt_stat.

Only AES-192 (cipher code 0x08) enables this because it sets

crypt_stat->key_size = 24 independently of encrypted_key_size,

allowing crypto_skcipher_setkey() to succeed while encrypted_key_size

exceeds ECRYPTFS_MAX_KEY_BYTES.

The PKI decryptio

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References