CVE-2026-89607

A flaw was found in ecryptfs in the Linux kernel. The parse_tag_3_packet() function does not properly validate the size of the encrypted key, allowing an oversized key to be processed. This improper validation leads to out-of-bounds writes, corrupting critical data structures within the ecryptfs_auth_tok and ecryptfs_crypt_stat structs. A local attacker could potentially exploit this memory corruption to achieve privilege escalation or cause a denial of service.

Red Hat has classified this vulnerability as having an Important impact because successful exploitation by an authenticated local user can trigger kernel memory corruption, potentially granting elevated privileges or crashing the system. The issue exists within the eCryptfs cryptographic filesystem subsystem during the handling of passphrase authentication tokens with specific cipher configurations. Exposure across standard enterprise deployments is significantly reduced because eCryptfs is not enabled in default Red Hat Enterprise Linux kernels. Exploitation requires an environment where eCryptfs is active and local unprivileged users can present crafted filesystem metadata.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.