CVE-2026-63824

A flaw was found in the Linux kernel's keyctl_pkey_params_get_2() function within the KEYS subsystem. The vulnerability arises from an incorrect calculation of the internal output buffer's length, which can lead to a buffer overflow when a user-provided buffer is too small. This flaw could allow a local attacker to corrupt memory, potentially leading to a denial of service or other unspecified impacts.

An IMPORTANT-impact flaw was found in the Linux kernel's KEYS subsystem, affecting the Red Hat Enterprise Linux 9 and 10 kernels and the Red Hat In-Vehicle OS 2 kernels. The keyctl_pkey_params_get_2() function calculates the length of the internal output buffer used for keyctl() public-key operations incorrectly, so a buffer overflow can occur when a caller supplies a buffer that is too small for the cryptographic operation being requested. A local user with low privileges who can invoke the keyctl() KEYCTL_PKEY operations could use this flaw to corrupt kernel memory, potentially causing a denial of service or other unspecified impact. Red Hat Product Security scores this flaw CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a higher attack complexity than the upstream CVE record score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Fixes are being pursued for the affected Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2 kernel streams. The Red Hat Enterprise Linux 6, 7, and 8 kernel and kernel-rt packages are not affected because the vulnerable code is not present in those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.