KernelScan.io

HIGH Introduced in 2.6.19

ecryptfs PacketSet OOB

CVE-2026-89608

CVSS 7.1 / 10.0 NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

KernelScan AI7.8HIGH

01

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfs_parse_packet_set() receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGE_SIZE - 8. For version 1 headers the packet set starts later in the header, so this can overstate the available buffer. Pass the actual packet set buffer length from the caller and calculate per-packet limits from the remaining bytes in that buffer. Recompute the remaining length after consuming a tag 3 packet before parsing the following tag 11 packet.

02

Engine v0.6.0

Risk summary

A local user who can mount an eCryptfs filesystem with a crafted file header can trigger out-of-bounds reads in the kernel. The bug overstates the available buffer size when parsing packet sets in version 1 headers, allowing reads beyond the allocated buffer. This can lead to information disclosure or kernel memory corruption.

Affectedfs/ecryptfs/keystore.c (ecryptfs)

Vulnerability analysis

The eCryptfs packet set parser miscalculates how much data remains in a file's header buffer. For older version 1 headers, the packet set begins later in the header, but the parser assumes a fixed larger size based on page size. This causes it to read past the end of valid data when processing crafted headers. The fix provides the actual buffer length from the caller and enforces proper bounds checking after each packet is consumed. The bug is reached when mounting or accessing an eCryptfs file with a malformed header, which requires a local user with filesystem access.

03

BranchIntroducedFixed inPatch commit
5.102.6.195.10.270e7573b0e3058
5.152.6.195.15.22166a87559ecb2
6.12.6.196.1.1883bd9bb3e167a
6.122.6.196.12.109329de8b9e988
6.182.6.196.18.50e5d254e654f2
6.62.6.196.6.157749fa08d8f1b
7.22.6.197.2.4747fd45be396
mainline2.6.197.32602b79c5b3e
cip/5.102.6.195.10.271-cip78e7573b0e3058
cip/6.12.6.196.1.189-cip613bd9bb3e167a
cip/6.1-rt2.6.196.1.189-cip61-rt323bd9bb3e167a
cip/6.122.6.196.12.111-cip32329de8b9e988

04

State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.

CIP treeState
cip/6.12Fixed in 6.12.111-cip32
cip/6.1Fixed in 6.1.189-cip61
cip/6.1-rtFixed in 6.1.189-cip61-rt32
cip/5.10Fixed in 5.10.271-cip78
cip/5.10-rtAffected — no CIP fix yet (latest 5.10.268-cip77-rt34)
cip/4.19Affected — no CIP fix yet (latest 4.19.325-cip136)
cip/4.19-rtAffected — no CIP fix yet (latest 4.19.325-cip136-rt50)
cip/4.4Affected — no CIP fix yet (latest 4.4.302-cip115)
cip/4.4-rtAffected — no CIP fix yet (latest 4.4.302-cip115-rt63)