CVE-2026-74567

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-74567
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74567.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-74567
Downstream
Published
2026-08-15T12:28:08Z
Modified
2026-08-21T03:30:38Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
Summary
keys: fix out-of-bounds read in keyring_get_key_chunk()
Details

In the Linux kernel, the following vulnerability has been resolved:

keys: fix out-of-bounds read in keyring_get_key_chunk()

For description-level chunks keyring_get_key_chunk() advances the read pointer by level * sizeof(long) past the inline prefix but only bounds-checks the prefix, so a long enough key description is read past its kmemdup(desc, desc_len + 1) allocation. Compute the full byte offset and bounds-check the description against it before reading.

The walk only reaches a description-level chunk when two keys collide through the hash, x, type and domain_tag chunks, so this is reached from an unprivileged add_key(2) with a crafted pair of same-type keys whose index hashes collide; KASAN reports a slab-out-of-bounds read.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74567.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f771fde82051976a6fc0fd570f8b86de4a92124b
Fixed
4c0c26f751e50d3027eacc4d7d0fabc31f1d7e6b
Fixed
79916f40d4ab1b4ae694d8c024fd179454bfe46e
Fixed
e5b01998cef8d7f613200230ccaadebe5de9135c
Fixed
d1933e03e8c74a018550c31a393b79c4d95bff40
Fixed
3a744838453fb9309ce5a5526d3252e211d60152
Fixed
e9417d21a22ad2ec398e78fcf084b717ce92cf2f
Fixed
8dba33c1e779d0fb9a2acb31e354cf0fc0229111
Fixed
63918731f9ae25b5deb022f118e941e6dddfcef4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74567.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.3.0
Fixed
5.10.265
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.216
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.183
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.151
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.103
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.44
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74567.json"