CVE-2026-89608

A flaw was found in the ecryptfs component of the Linux kernel. The ecryptfs_parse_packet_set() function incorrectly calculates the available buffer size when processing version 1 headers, leading to an overstatement of the buffer's actual capacity. This miscalculation could allow an attacker to cause a denial of service or potentially lead to information disclosure due to out-of-bounds memory access.

A flaw of MODERATE severity was found in the eCryptfs file encryption subsystem of the Linux kernel. The ecryptfs_parse_packet_set() function derived the remaining packet-set buffer size from PAGE_SIZE - 8 instead of using the actual length of the packet set within the file header. For version 1 headers, where the packet set starts later in the header, this overstates the available buffer: a local user able to place or access an eCryptfs-encrypted file with a crafted version 1 header on an affected system can make the kernel parse past the end of the real packet buffer when consuming the tag 3 and tag 11 packets, resulting in an out-of-bounds memory access. The established impact is a kernel panic and local denial of service; the out-of-bounds access is a read primitive, and neither privilege escalation nor integrity impact is established.

Within the Red Hat product portfolio, only OpenShift Container Platform 5.0 and 5.1 (which ship a RHEL CoreOS 9 kernel) are affected, and the fix for those streams is currently deferred; the residual risk is limited to local denial of service triggered by a crafted on-disk eCryptfs header. Red Hat Enterprise Linux 7 through 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and OpenShift Container Platform 4.z are recorded as not affected because the vulnerable code is not present in those builds, and Red Hat Enterprise Linux 6 ELS is out of support scope.

Red Hat's severity of MODERATE (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is lower than the upstream CVE record rating of IMPORTANT (CVSS 7.1), which assumes high confidentiality impact from the out-of-bounds read. Red Hat's assessment does not establish such an information-disclosure impact and treats this flaw as primarily affecting availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.