kernel: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet (CVE-2026-89607)

Overview

A flaw was found in ecryptfs in the Linux kernel. The parse_tag_3_packet() function does not properly validate the size of the encrypted key, allowing an oversized key to be processed. This improper validation leads to out-of-bounds writes, corrupting critical data structures within the ecryptfs_auth_tok and ecryptfs_crypt_stat structs. A local attacker could potentially exploit this memory corruption to achieve privilege escalation or cause a denial of service.

Vendor advisories

• Red Hat VEX · Important · affected: Red Hat Enterprise Linux 6 · updated 2026-09-15 · vex

kernel: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet — rated Important by Red Hat. Released 2026-09-11, updated 2026-09-15.

Affected:

• Red Hat Enterprise Linux 6

Not affected:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat OpenShift Container Platform 4

Remediation

Refer to the advisory for fix availability.