HIGH Introduced in 4.20
KEYS PkeyParams Overflow
CVE-2026-63824
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: KEYS: fix overflow in keyctl_pkey_params_get_2() The length for the internal output buffer is calculated incorrectly, which can result overflow when a too small buffer is provided. Fix the bug by allocating internal output with the size of the maximum length of the cryptographic primitive instead of caller provided size.
02KernelScan AI Analysis
Risk summary
A local unprivileged user can trigger a heap buffer overflow in the kernel's asymmetric key cryptographic operations by supplying a smaller-than-maximum output buffer length via keyctl(). The crypto primitive writes up to its maximum output size into an undersized internally-allocated buffer, leading to kernel heap corruption that can enable privilege escalation, arbitrary code execution, or kernel crash. Any system where unprivileged users or untrusted code can access asymmetric keys is affected.
Vulnerability analysis
The vulnerability is in keyctl_pkey_params_get_2() in security/keys/keyctl_pkey.c. The function validates that user-supplied in_len and out_len do not exceed the cryptographic primitive's maximum sizes, but then stores the user-supplied out_len (uparams.out_len) directly into params->out_len. The internal output buffer is subsequently allocated based on params->out_len, while the cryptographic operation writes up to the maximum size for the operation (e.g., max_enc_size, max_dec_size, max_sig_size). If the user provides an out_len smaller than the maximum, the allocated buffer is too small and the crypto operation overflows it, causing a heap buffer overflow. The fix replaces the user-supplied out_len with the actual maximum size for the operation so the internal buffer is always large enough. The attack surface is local: any process that can call keyctl() with KEYCTL_PKEY_ENCRYPT/DECRYPT/SIGN/VERIFY and has access to an asymmetric key can trigger this. No special privileges beyond key access are required, making this reachable by unprivileged local users and container tenants.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.20 | 5.10.260 | 622ec2dcd59f |
| 5.15 | 4.20 | 5.15.211 | b1e247338bc7 |
| 6.1 | 4.20 | 6.1.177 | 0f3058d7d26f |
| 6.6 | 4.20 | 6.6.144 | 5966e4e2ba21 |
| 6.12 | 4.20 | 6.12.95 | 5165f1cc727f |
| 6.18 | 4.20 | 6.18.38 | b11c1fa32667 |
| 7.1 | 4.20 | 7.1.3 | 670fc6a311ed |
| mainline | 4.20 | 7.2-rc1 | cb481e59ea6c |