HIGH Introduced in 2.6.19
ecryptfs PacketSet OOB
CVE-2026-89608
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfs_parse_packet_set() receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGE_SIZE - 8. For version 1 headers the packet set starts later in the header, so this can overstate the available buffer. Pass the actual packet set buffer length from the caller and calculate per-packet limits from the remaining bytes in that buffer. Recompute the remaining length after consuming a tag 3 packet before parsing the following tag 11 packet.
02KernelScan AI Analysis
Risk summary
A local user who can mount an eCryptfs filesystem with a crafted file header can trigger out-of-bounds reads in the kernel. The bug overstates the available buffer size when parsing packet sets in version 1 headers, allowing reads beyond the allocated buffer. This can lead to information disclosure or kernel memory corruption.
Vulnerability analysis
The eCryptfs packet set parser miscalculates how much data remains in a file's header buffer. For older version 1 headers, the packet set begins later in the header, but the parser assumes a fixed larger size based on page size. This causes it to read past the end of valid data when processing crafted headers. The fix provides the actual buffer length from the caller and enforces proper bounds checking after each packet is consumed. The bug is reached when mounting or accessing an eCryptfs file with a malformed header, which requires a local user with filesystem access.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.19 | 5.10.270 | e7573b0e3058 |
| 5.15 | 2.6.19 | 5.15.221 | 66a87559ecb2 |
| 6.1 | 2.6.19 | 6.1.188 | 3bd9bb3e167a |
| 6.12 | 2.6.19 | 6.12.109 | 329de8b9e988 |
| 6.18 | 2.6.19 | 6.18.50 | e5d254e654f2 |
| 6.6 | 2.6.19 | 6.6.157 | 749fa08d8f1b |
| 7.2 | 2.6.19 | 7.2.4 | 747fd45be396 |
| mainline | 2.6.19 | 7.3 | 2602b79c5b3e |
| cip/5.10 | 2.6.19 | 5.10.271-cip78 | e7573b0e3058 |
| cip/6.1 | 2.6.19 | 6.1.189-cip61 | 3bd9bb3e167a |
| cip/6.1-rt | 2.6.19 | 6.1.189-cip61-rt32 | 3bd9bb3e167a |
| cip/6.12 | 2.6.19 | 6.12.111-cip32 | 329de8b9e988 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |