Bug 2516989 (CVE-2026-74567)

Summary: CVE-2026-74567 kernel: keys: fix out-of-bounds read in keyring_get_key_chunk()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's key management subsystem. An unprivileged local attacker could exploit an out-of-bounds read vulnerability in the `keyring_get_key_chunk()` function. By providing specially crafted keys, the attacker can cause the system to read beyond its intended memory boundaries. This could lead to the disclosure of sensitive information or a system crash (denial of service).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 12:43:13 UTC 
In the Linux kernel, the following vulnerability has been resolved:

keys: fix out-of-bounds read in keyring_get_key_chunk()

For description-level chunks keyring_get_key_chunk() advances the read
pointer by level * sizeof(long) past the inline prefix but only
bounds-checks the prefix, so a long enough key description is read past
its kmemdup(desc, desc_len + 1) allocation.  Compute the full byte
offset and bounds-check the description against it before reading.

The walk only reaches a description-level chunk when two keys collide
through the hash, x, type and domain_tag chunks, so this is reached from
an unprivileged add_key(2) with a crafted pair of same-type keys whose
index hashes collide; KASAN reports a slab-out-of-bounds read.
Comment 1 gkamathe 2026-08-21 09:29:41 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081553-CVE-2026-74567-3050@gregkh/T