Executive brief
A vulnerability was identified in the Linux kernel's key management system, which handles security credentials and cryptographic keys. An error in how the system calculates memory requirements for certain cryptographic operations could allow a local attacker to cause a buffer overflow. This could potentially lead to a system crash or unauthorized access to sensitive information stored in the kernel.
Technical details
A buffer overflow vulnerability exists in 'security/keys/keyctl_pkey.c' within the 'keyctl_pkey_params_get_2()' function of the Linux kernel. The root cause is an incorrect calculation of the internal output buffer length; specifically, the kernel was using a caller-provided size instead of the maximum length required by the cryptographic primitive. This flaw can be triggered during KEYCTL_PKEY_ENCRYPT, DECRYPT, SIGN, or VERIFY operations if a user provides a buffer size that is too small. A local attacker could exploit this to cause memory corruption. The fix involves ensuring the internal output buffer is allocated based on the maximum length of the cryptographic primitive (e.g., info.max_enc_size, info.max_sig_size) rather than the user-supplied length.
Affected products
- Linux Linux Kernel v4.20 to v6.13.y
Timeline
- 2026-06-01: other: Vulnerability fixed in upstream commits
- 2026-07-19: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/0f3058d7d26f81df9b68a18ddbe164bdc3c5eff3
- https://git.kernel.org/stable/c/5165f1cc727f1322456735df212d8e26ec237a8d
- https://git.kernel.org/stable/c/5966e4e2ba213ab7ad559166152eb4f1f170dd2c
- https://git.kernel.org/stable/c/622ec2dcd59f21623f2a7ab773c80ceb7d555e3a
- https://git.kernel.org/stable/c/670fc6a311ed321522b7fff92cf0fc376b4f6e78
- https://git.kernel.org/stable/c/b11c1fa32667692a2c0566e10163758e786e430c
- https://git.kernel.org/stable/c/b1e247338bc71826a2d2def3e0874c34749df69a