CVE-2026-74567

A flaw was found in the Linux kernel's key management subsystem. An unprivileged local attacker could exploit an out-of-bounds read vulnerability in the keyring_get_key_chunk() function. By providing specially crafted keys, the attacker can cause the system to read beyond its intended memory boundaries. This could lead to the disclosure of sensitive information or a system crash (denial of service).

A moderate out-of-bounds read flaw was found in the Linux kernel's key management subsystem. When walking description-level key chunks, keyring_get_key_chunk() advances the read pointer past the inline prefix without bounds-checking the full byte offset against the key description length, so a sufficiently long key description can be read past its allocation. A local unprivileged attacker could trigger this flaw through the add_key(2) system call by creating a crafted pair of same-type keys whose index hashes collide, causing a slab out-of-bounds read that could crash the system (denial of service) or disclose a limited amount of kernel memory. The kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10 and in Red Hat In-Vehicle OS 2 are affected, and the fix for these streams has been deferred to a future update, so the residual risk is that a local unprivileged user can trigger the out-of-bounds read until a fixed kernel is delivered. The Red Hat Enterprise Linux 6 Extended Lifecycle Support stream is out of support scope, and Red Hat Enterprise Linux 7 and 8 are not affected because the vulnerable code is not present in their kernels. Red Hat rates this flaw as Moderate impact (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the upstream CVE.org rating of Important (score 7.1), because Red Hat's assessment finds the impact on Red Hat products to be limited to availability with no confidentiality impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.