KEYS: encrypted: fix integer overflow of datablob_len (Linux Linux)

CVE-2026-98222
Non disponible

En bref

Source
NVD
EPSS
EPSS 0.17 % · centile 6 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Received

Description

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of datablob_len encrypted_key_alloc() stores datablob_len in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16_MAX, the assignment truncates the allocation size. KASAN reports a 32760-byte slab-out-of-bounds write when __ekey_init() copies the master key description into the undersized buffer. The total payload length stored in key->datalen is also a u16. Use check_add_overflow() to reject values that do not fit either destination, and use kzalloc_flex() for the flexible-array allocation.

Références

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
Linux · Linuxaffected 7e70cb4978507cf31d76b90e4cfb4c28cad87f0c < 1e720f63dbafc093a8f5d519f05b67724993edd4 ; affected 7e70cb4978507cf31d76b90e4cfb4c28cad87f0c < a1a98eca102b1cbbc37ff9eaa197ae4e6a3ea4b0 ; affected 7e70cb4978507cf31d76b90e4cfb4c28cad87f0c < cca38f2102a4cd35eda8d48950df4817b4b24757 ; affected 7e70cb4978507cf31d76b90e4cfb4c28cad87f0c < 8697c431e297eb0d0ab13dda6bc172b48a34f05c
Linux · Linuxaffected 2.6.38 ; unaffected 0 < 2.6.38 ; unaffected 6.12.112 ≤ 6.12.* ; unaffected 6.18.54 ≤ 6.18.* ; unaffected 7.2.8 ≤ 7.2.* ; unaffected 7.3 ≤ *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD