{"id":"AZL-100863","summary":"CVE-2026-89607 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\necryptfs: reject oversized encrypted_key_size in parse_tag_3_packet\n\nparse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body\nwithout bounding it against ECRYPTFS_MAX_KEY_BYTES (64). When\nencrypted_key_size \u003e 64, decrypt_passphrase_encrypted_session_key()\nsets decrypted_key_size = encrypted_key_size and performs two\nout-of-bounds writes:\n\n1. crypto_skcipher_decrypt() writes encrypted_key_size bytes into\n   decrypted_key[64] via scatterlist, overflowing into the parent\n   ecryptfs_auth_tok struct.\n2. memcpy(crypt_stat-\u003ekey, decrypted_key, decrypted_key_size) writes\n   into crypt_stat-\u003ekey[64], corrupting root_iv, keysig_list, and\n   mutexes in ecryptfs_crypt_stat.\n\nOnly AES-192 (cipher code 0x08) enables this because it sets\ncrypt_stat-\u003ekey_size = 24 independently of encrypted_key_size,\nallowing crypto_skcipher_setkey() to succeed while encrypted_key_size\nexceeds ECRYPTFS_MAX_KEY_BYTES.\n\nThe PKI decryption path (parse_tag_65_packet) already validates\ndecrypted_key_size \u003c= ECRYPTFS_MAX_KEY_BYTES; the passphrase path\nomits this check.\n\nBound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64) rather\nthan ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES (512). The 64-byte limit also\nprotects the 512-byte encrypted_key[] buffer, so the former 512-byte\ncheck is removed as redundant.\n\n[tyhicks: Adjust the code comment to refer to macros representing the\n buffer sizes rather than mentioning the buffer size values since they\n may change in the future]","modified":"2026-09-14T05:26:59Z","published":"2026-09-11T20:19:45Z","upstream":["CVE-2026-89607"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89607"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-100863.json"}}],"schema_version":"1.9.0"}