CVE-2026-74567

In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyring_get_key_chunk() For description-level chunks keyring_get_key_chunk() advances the read pointer by level * sizeof(long) past the inline prefix but only bounds-checks the prefix, so a long enough key description is read past its kmemdup(desc, desc_len + 1) allocation. Compute the full byte offset and bounds-check the description against it before reading. The walk only reaches a description-level chunk when two keys collide through the hash, x, type and domain_tag chunks, so this is reached from an unprivileged add_key(2) with a crafted pair of same-type keys whose index hashes collide; KASAN reports a slab-out-of-bounds read.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/3a744838453fb9309ce5a5526d3252e211d60152
https://git.kernel.org/stable/c/4c0c26f751e50d3027eacc4d7d0fabc31f1d7e6b
https://git.kernel.org/stable/c/63918731f9ae25b5deb022f118e941e6dddfcef4
https://git.kernel.org/stable/c/79916f40d4ab1b4ae694d8c024fd179454bfe46e
https://git.kernel.org/stable/c/8dba33c1e779d0fb9a2acb31e354cf0fc0229111
https://git.kernel.org/stable/c/d1933e03e8c74a018550c31a393b79c4d95bff40
https://git.kernel.org/stable/c/e5b01998cef8d7f613200230ccaadebe5de9135c
https://git.kernel.org/stable/c/e9417d21a22ad2ec398e78fcf084b717ce92cf2f

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-15 13:18

Updated : 2026-08-19 17:21

NVD link : CVE-2026-74567

Mitre link : CVE-2026-74567

CVE.ORG link : CVE-2026-74567

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-74567", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f771fde82051976a6fc0fd570f8b86de4a92124b", "lessThan": "4c0c26f751e50d3027eacc4d7d0fabc31f1d7e6b", "versionType": "git"}, {"status": "affected", "version": "f771fde82051976a6fc0fd570f8b86de4a92124b", "lessThan": "79916f40d4ab1b4ae694d8c024fd179454bfe46e", "versionType": "git"}, {"status": "affected", "version": "f771fde82051976a6fc0fd570f8b86de4a92124b", "lessThan": "e5b01998cef8d7f613200230ccaadebe5de9135c", "versionType": "git"}, {"status": "affected", "version": "f771fde82051976a6fc0fd570f8b86de4a92124b", "lessThan": "d1933e03e8c74a018550c31a393b79c4d95bff40", "versionType": "git"}, {"status": "affected", "version": "f771fde82051976a6fc0fd570f8b86de4a92124b", "lessThan": "3a744838453fb9309ce5a5526d3252e211d60152", "versionType": "git"}, {"status": "affected", "version": "f771fde82051976a6fc0fd570f8b86de4a92124b", "lessThan": "e9417d21a22ad2ec398e78fcf084b717ce92cf2f", "versionType": "git"}, {"status": "affected", "version": "f771fde82051976a6fc0fd570f8b86de4a92124b", "lessThan": "8dba33c1e779d0fb9a2acb31e354cf0fc0229111", "versionType": "git"}, {"status": "affected", "version": "f771fde82051976a6fc0fd570f8b86de4a92124b", "lessThan": "63918731f9ae25b5deb022f118e941e6dddfcef4", "versionType": "git"}], "programFiles": ["security/keys/keyring.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"status": "unaffected", "version": "0", "lessThan": "5.3", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.151", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.103", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.44", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.8", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["security/keys/keyring.c"], "defaultStatus": "affected"}]}], "published": "2026-08-15T13:18:02.227", "references": [{"url": "https://git.kernel.org/stable/c/3a744838453fb9309ce5a5526d3252e211d60152", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4c0c26f751e50d3027eacc4d7d0fabc31f1d7e6b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/63918731f9ae25b5deb022f118e941e6dddfcef4", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/79916f40d4ab1b4ae694d8c024fd179454bfe46e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8dba33c1e779d0fb9a2acb31e354cf0fc0229111", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d1933e03e8c74a018550c31a393b79c4d95bff40", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e5b01998cef8d7f613200230ccaadebe5de9135c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e9417d21a22ad2ec398e78fcf084b717ce92cf2f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: fix out-of-bounds read in keyring_get_key_chunk()\n\nFor description-level chunks keyring_get_key_chunk() advances the read\npointer by level * sizeof(long) past the inline prefix but only\nbounds-checks the prefix, so a long enough key description is read past\nits kmemdup(desc, desc_len + 1) allocation. Compute the full byte\noffset and bounds-check the description against it before reading.\n\nThe walk only reaches a description-level chunk when two keys collide\nthrough the hash, x, type and domain_tag chunks, so this is reached from\nan unprivileged add_key(2) with a crafted pair of same-type keys whose\nindex hashes collide; KASAN reports a slab-out-of-bounds read."}], "lastModified": "2026-08-19T17:21:11.563", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}