Skip to main content

Linux Kernel CVE-2026-74567

| EUVDEUVD-2026-59632 HIGH
2026-08-15 Linux GHSA-fp4g-wh5w-9xf4
Buffer Overflow Linux
7.1
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain unprivileged local user shell
  2. Delivery
    Craft two same-type keys with engineered multi-level hash collisions
  3. Exploit
    Call add_key(2) to insert both keys
  4. Execution
    Trigger keyring tree walk to description-level chunk
  5. Persist
    Out-of-bounds slab read executes
  6. Impact
    Leak adjacent kernel heap memory or crash kernel

Vulnerability Assessment

Exploitation Conditions

Exploitation requires a local user account with the ability to invoke the add_key(2) syscall, which is permitted to all unprivileged users by default on standard Linux distributions. The critical technical prerequisite is crafting two keys of the same type whose index hashes collide through all four levels of the keyring tree (hash, x/name-hash, type, and domain_tag chunks) - requiring deliberate hash collision engineering, not merely arbitrary key addition. Exploitation is blocked when: (1) add_key(2) is denied by a seccomp-bpf filter (as is common in restrictive container runtimes such as gVisor or hardened Docker profiles), (2) AppArmor or SELinux policy prohibits keyring operations for the user context, or (3) untrusted local user access to the host is absent. No network vector, no authentication bypass, and no elevated capability (e.g., CAP_SYS_ADMIN) is required.
Impact

The NVD CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, score 7.1) indicates local, low-complexity, low-privilege exploitation with high confidentiality and availability impacts. However, AC:L materially understates practical difficulty: triggering the description-level code path requires engineering hash collisions across multiple tree levels (hash, x, type, domain_tag), which is technically non-trivial even if theoretically deterministic. EPSS at 0.16% (5th percentile) corroborates low near-term exploitation probability, and the vulnerability is absent from CISA KEV with no known public POC. Real-world priority is highest for multi-tenant Linux deployments - shared hosting, Kubernetes nodes with untrusted workloads, or VMs shared across trust boundaries - where any local user can call add_key(2). On hardened systems with seccomp-bpf or AppArmor policies restricting keyring syscalls, exploitation is blocked entirely. The discrepancy between AC:L in the provided CVSS vector and the multi-level hash collision requirement is noted - defenders should treat effective complexity as higher than the raw score implies.
Exploit ScenarioDerived

An unprivileged attacker with a local shell account calls add_key(2) twice with same-type keys engineered so their index hashes collide through the hash, x, type, and domain_tag levels of the keyring tree, forcing keyring_get_key_chunk() to enter the description-level walk. The unchecked offset read past the kmemdup allocation leaks adjacent kernel slab contents - potentially exposing keys, kernel pointers, or cryptographic material - and may panic the kernel, causing a denial of service. No public POC exists at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 17, 2026

Out-of-bounds slab read in the Linux kernel keyring subsystem's keyring_get_key_chunk() exposes kernel heap memory and enables potential kernel crashes from any unprivileged local user account. Affected kernels fail to bounds-check the full computed byte offset when walking description-level key chunks, allowing reads past a kmemdup-allocated buffer. This is reachable via the standard add_key(2) syscall with no elevated privileges and is confirmed by KASAN as a slab-out-of-bounds read; no public exploit exists and EPSS is 0.16% (5th percentile), but multi-tenant and container environments with untrusted local users face meaningful exposure.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6 (or later), selecting the branch that matches the current deployment; upstream fix commits are available at the kernel stable tree (https://git.kernel.org/stable/c/). Distribution vendors (RHEL, Ubuntu, SUSE, Debian) are expected to backport fixes to their own kernel packages - consult vendor security advisories for distribution-specific patched package versions. For systems that cannot be patched immediately, restrict access to the add_key(2) syscall via a seccomp-bpf profile or AppArmor/SELinux policy; note that this may break applications relying on the kernel keyring (e.g., FSCRYPT volume unlock, CIFS/SMB mounts with kernel keyring credentials, or Kerberos via GSSAPI with kernel keytabs). Disabling untrusted local user access to the system is the most effective compensating control where keyring syscall restriction is impractical.

Affected VersionsENISA

Linux f771fde82051976a6fc0fd570f8b86de4a92124b <e9417d21a22ad2ec398e78fcf084b717ce92cf2f
Linux f771fde82051976a6fc0fd570f8b86de4a92124b <8dba33c1e779d0fb9a2acb31e354cf0fc0229111
Linux f771fde82051976a6fc0fd570f8b86de4a92124b <d1933e03e8c74a018550c31a393b79c4d95bff40
Linux patch: 0
Linux f771fde82051976a6fc0fd570f8b86de4a92124b <3a744838453fb9309ce5a5526d3252e211d60152
Linux 5.3
Linux patch: 6.12.103
Linux f771fde82051976a6fc0fd570f8b86de4a92124b <63918731f9ae25b5deb022f118e941e6dddfcef4
Linux patch: 6.18.44
Linux patch: 6.6.151
Linux patch: 7.2-rc6
Linux patch: 7.1.8

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability is in the Linux kernel's key management subsystem (security/keys/keyring.c). During a keyring tree walk, keyring_get_key_chunk() processes description-level chunks by advancing the read pointer by level * sizeof(long) bytes past the inline prefix. However, bounds validation is performed only against the prefix length, not the full computed offset into the allocation. Because the buffer was created via kmemdup(desc, desc_len + 1), any offset that exceeds desc_len + 1 reads unallocated slab memory. The description-level chunk path is reached only when two keys collide through all prior tree levels - hash, x (name hash), type, and domain_tag - meaning the attacker must engineer multi-level hash collisions using crafted key pairs of the same type. Affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* beginning from commit f771fde82051976a6fc0fd570f8b86de4a92124b. The root cause maps to CWE-125 (Out-of-bounds Read), tagged as a buffer overflow class by ENISA (EUVD-2026-59632).

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI 6.3 MEDIUM

Multi-level hash collision requirement across four keyring tree levels warrants AC:H; local syscall invocation and unprivileged trigger confirm AV:L and PR:L; no integrity impact observed.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.1 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:28 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:28 cve.org
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

keys: fix out-of-bounds read in keyring_get_key_chunk()

For description-level chunks keyring_get_key_chunk() advances the read pointer by level * sizeof(long) past the inline prefix but only bounds-checks the prefix, so a long enough key description is read past its kmemdup(desc, desc_len + 1) allocation. Compute the full byte offset and bounds-check the description against it before reading.

The walk only reaches a description-level chunk when two keys collide through the hash, x, type and domain_tag chunks, so this is reached from an unprivileged add_key(2) with a crafted pair of same-type keys whose index hashes collide; KASAN reports a slab-out-of-bounds read.

Executive ViewAI

Why It Matters

The Linux kernel keyring subsystem contains a memory safety defect (CVE-2026-74567) allowing unprivileged local users to extract sensitive kernel memory and crash systems; no public exploit identified at time of analysis. Multi-tenant infrastructure and container platforms face material risk from untrusted workloads. Patched kernels are available and should be deployed urgently.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Ubiquitous
Linux kernel underlies virtually all cloud, server, container, and embedded production environments
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-74567 ADVISORY https://ubuntu.com/security/notices/USN-8876-1 ADVISORY https://ubuntu.com/security/notices/USN-8877-1 ADVISORY https://ubuntu.com/security/notices/USN-8878-1 ADVISORY https://ubuntu.com/security/notices/USN-8879-1 ADVISORY https://vuldb.com/vuln/390893 REF https://git.kernel.org/stable/c/3a744838453fb9309ce5a5526d3252e211d60152 REF https://git.kernel.org/stable/c/4c0c26f751e50d3027eacc4d7d0fabc31f1d7e6b REF https://git.kernel.org/stable/c/63918731f9ae25b5deb022f118e941e6dddfcef4 REF https://git.kernel.org/stable/c/79916f40d4ab1b4ae694d8c024fd179454bfe46e REF https://git.kernel.org/stable/c/8dba33c1e779d0fb9a2acb31e354cf0fc0229111 REF https://git.kernel.org/stable/c/d1933e03e8c74a018550c31a393b79c4d95bff40 REF https://git.kernel.org/stable/c/e5b01998cef8d7f613200230ccaadebe5de9135c REF https://git.kernel.org/stable/c/e9417d21a22ad2ec398e78fcf084b717ce92cf2f

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy