Description

In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyring_get_key_chunk() For description-level chunks keyring_get_key_chunk() advances the read pointer by level * sizeof(long) past the inline prefix but only bounds-checks the prefix, so a long enough key description is read past its kmemdup(desc, desc_len + 1) allocation. Compute the full byte offset and bounds-check the description against it before reading. The walk only reaches a description-level chunk when two keys collide through the hash, x, type and domain_tag chunks, so this is reached from an unprivileged add_key(2) with a crafted pair of same-type keys whose index hashes collide; KASAN reports a slab-out-of-bounds read.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-15T13:18:02.227Z",
  "pubdate": "2026-08-15T13:18:02.227Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in the Linux kernel keyring subsystem, specifically within the keyring_get_key_chunk() function. The vulnerability is classified as an out-of-bounds read, leading to potential information disclosure or kernel instability.\nThe affected product is the Linux kernel keyring subsystem. Unprivileged local attackers can exploit this vulnerability to trigger a slab-out-of-bounds read.\nExploitation requires the attacker to have local execution privileges and the ability to invoke the add_key(2) system call. The attack vector relies on crafting a specific pair of same-type keys designed to collide through the hash, x, type, and domain_tag chunks, forcing the radix tree walk to reach a description-level chunk.\nThe risk implication involves unauthorized access to kernel memory adjacent to the kmemdup allocation of the key description, which could expose sensitive data or cause kernel crashes via memory management faults detected by KASAN.",
  "technicalDetails": "The vulnerability resides in the keyring_get_key_chunk() function within the Linux kernel keyring implementation. The root cause is improper bounds checking during the processing of description-level chunks.\nDuring the retrieval of key chunks, keyring_get_key_chunk() advances the read pointer by level * sizeof(long) past the inline prefix. However, the function only bounds-checks the prefix itself rather than the total calculated offset.\nConsequently, when a key description is sufficiently long, the read operation extends past the boundary of the memory allocated by kmemdup(desc, desc_len + 1), resulting in a slab-out-of-bounds read.\nThe attack flow requires an unprivileged local user to invoke the add_key(2) system call with a crafted pair of keys. These keys must share the same type and produce index hash collisions across the hash, x, type, and domain_tag chunks. When these conditions are met, the internal keyring search walk reaches a description-level chunk, triggering the flawed offset calculation.\nAuthentication and privilege requirements are minimal, as the add_key(2) system call is accessible to unprivileged local users. The vulnerability does not involve network exposure, operating entirely within local kernel space via system call interfaces.\nUpon successful triggering, KASAN (KernelAddressSanitizer) detects the slab-out-of-bounds read. The post-exploitation impact includes potential kernel memory disclosure or denial of service through kernel panics induced by reading unmapped or restricted memory pages."
}