CVE-2026-98222

A flaw was found in the Linux kernel's encrypted keys subsystem. An integer overflow occurs during memory size calculations for key data, resulting in an undersized buffer allocation. A local user can exploit this issue by supplying crafted key data to trigger an out-of-bounds write to kernel memory. This flaw can lead to a system crash, resulting in a Denial of Service (DoS), or potentially allow privilege escalation.

Red Hat Product Security rates this flaw as IMPORTANT for the affected Red Hat products. A flaw was found in the Linux kernel's encrypted keys subsystem: encrypted_key_alloc() stores datablob_len in a u16 that is computed from multiple string and payload lengths, and when the computed length exceeds U16_MAX the stored value is truncated, resulting in an undersized buffer allocation. A slab-out-of-bounds write then occurs when __ekey_init() copies the key data into the undersized buffer. A local user able to create keys, for example via the add_key() syscall, can supply crafted key data to trigger this out-of-bounds write to kernel memory, which can cause a system crash and denial of service, or potentially allow privilege escalation. Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in that stream. Red Hat Enterprise Linux 7 ELS, 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm) are affected, and fixes are being pursued for these products. Red Hat has assigned this flaw a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a local attack vector with high attack complexity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.