CVE-2026-74567keys: fix out-of-bounds read in keyring_get_key_chunk()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyring_get_key_chunk() For description-level chunks keyring_get_key_chunk() advances the read pointer by level * sizeof(long) past the inline prefix but only bounds-checks the prefix, so a long enough key description is read past its kmemdup(desc, desc_len + 1) allocation. Compute the full byte offset and bounds-check the description against it before reading. The walk only reaches a description-level chunk when two keys collide through the hash, x, type and domain_tag chunks, so this is reached from an unprivileged add_key(2) with a crafted pair of same-type keys whose index hashes collide; KASAN reports a slab-out-of-bounds read.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f771fde82051976a6fc0fd570f8b86de4a92124b before 4c0c26f751e50d3027eacc4d7d0fabc31f1d7e6b; from f771fde82051976a6fc0fd570f8b86de4a92124b before 79916f40d4ab1b4ae694d8c024fd179454bfe46e; from f771fde82051976a6fc0fd570f8b86de4a92124b before e5b01998cef8d7f613200230ccaadebe5de9135c; from f771fde82051976a6fc0fd570f8b86de4a92124b before d1933e03e8c74a018550c31a393b79c4d95bff40; from f771fde82051976a6fc0fd570f8b86de4a92124b before 3a744838453fb9309ce5a5526d3252e211d60152; from f771fde82051976a6fc0fd570f8b86de4a92124b before e9417d21a22ad2ec398e78fcf084b717ce92cf2f; from f771fde82051976a6fc0fd570f8b86de4a92124b before 8dba33c1e779d0fb9a2acb31e354cf0fc0229111; from f771fde82051976a6fc0fd570f8b86de4a92124b before 63918731f9ae25b5deb022f118e941e6dddfcef4 | CNA record |
References
- https://git.kernel.org/stable/c/4c0c26f751e50d3027eacc4d7d0fabc31f1d7e6b
- https://git.kernel.org/stable/c/79916f40d4ab1b4ae694d8c024fd179454bfe46e
- https://git.kernel.org/stable/c/e5b01998cef8d7f613200230ccaadebe5de9135c
- https://git.kernel.org/stable/c/d1933e03e8c74a018550c31a393b79c4d95bff40
- https://git.kernel.org/stable/c/3a744838453fb9309ce5a5526d3252e211d60152
- https://git.kernel.org/stable/c/e9417d21a22ad2ec398e78fcf084b717ce92cf2f
- https://git.kernel.org/stable/c/8dba33c1e779d0fb9a2acb31e354cf0fc0229111
- https://git.kernel.org/stable/c/63918731f9ae25b5deb022f118e941e6dddfcef4
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.