Executive brief
The Linux kernel's keyring subsystem contains a byte order mismatch between two functions that index cryptographic keys. This flaw allows an attacker to craft key descriptions that artificially collide, potentially causing keys to be stored and retrieved incorrectly. While add, search, and read operations for non-colliding keys are unaffected, a successful collision attack could lead to denial of service or unauthorized access to keys in the keyring.
Technical details
The vulnerability is a logical flaw in security/keys/keyring.c where keyring_get_key_chunk() loads description bytes in little-endian order, while keyring_diff_objects() assumes big-endian ordering and performs bit position calculations without accounting for the inline-prefix offset. This causes the two functions to disagree on which byte position differs first, allowing an attacker to craft key descriptions that appear to differ at a bit position that actually matches in the chunk the walker uses. The fix involves changing the byte load direction in keyring_get_key_chunk() and adjusting the level calculation in keyring_diff_objects() to remove the inline-prefix offset. The vulnerable component is the key storage and retrieval mechanism in the kernel's key management subsystem, reachable by unprivileged processes creating keys. No privilege escalation or user interaction is required beyond crafting malicious key descriptions.
Affected products
- Linux Linux kernel multiple versions from 2.6.11 through 6.x and later (all versions affected until patch applied)
Timeline
- 2026-08-15: disclosed: CVE-2026-74566 published
- 2026-08-09: patched: Fix committed by Greg Kroah-Hartman (upstream commit 58565eef0f8d861aae92abfb7658458d661cee17)
- 2026-07-19: other: Initial fix authored by Michael Bommarito