Executive brief
The Linux kernel's eCryptfs filesystem component has a buffer management flaw in its encrypted packet parsing logic. When processing file headers with version 1 format, the code miscalculates available buffer space, potentially allowing reads beyond the intended boundary. An attacker with access to specially crafted eCryptfs files could trigger memory disclosure or system instability.
Technical details
The ecryptfs_parse_packet_set() function in fs/ecryptfs/keystore.c miscalculates the size of the packet set buffer. It previously derived the maximum packet size from (PAGE_SIZE - 8) minus the current offset, but for version 1 encrypted file headers the packet set begins at a non-zero offset within the header page, causing the calculation to overstate available buffer space. The vulnerability is an out-of-bounds read that occurs when parsing tag 3 and tag 11 encryption packets. The fix adds an explicit src_size parameter to the function and uses it to enforce per-packet bounds checking, preventing reads beyond the actual packet set buffer.
Affected products
- Linux Linux kernel 2.6.11 through 6.19 and later (multiple stable branches)
Timeline
- 2026-09-11: disclosed
- 2026-07-20: patched: Upstream fix committed