EUVD-2026-76518
GHSA-x8vp-v84j-h4hg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack via crafted filesystem image, unprivileged user access sufficient, no interaction required, full kernel heap impact plausible from underflow.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ecryptfs: reject too-small tag 70 packets
ecryptfs_parse_tag_70_packet() subtracts fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixed fields can underflow that size calculation.
Reject tag 70 packets before the subtraction unless the body contains the signature, cipher code, and at least one byte of encrypted filename data.
AnalysisAI
Integer underflow in the Linux kernel's eCryptfs filename-encryption parser allows a local attacker to trigger heap memory corruption by supplying a crafted tag 70 packet with a body shorter than the fixed metadata fields. The underflow causes ecryptfs_parse_tag_70_packet() to derive a wildly inflated encrypted-filename size, enabling out-of-bounds heap reads or writes with full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the eCryptfs kernel module to be loaded and in active use - this is not a default configuration on most modern Linux distributions, which favor dm-crypt/LUKS or fscrypt; (2) the attacker to be able to trigger parsing of a crafted tag 70 packet, which most naturally occurs by mounting a malicious eCryptfs filesystem image or by placing a crafted file in an eCryptfs-backed directory accessible to the attacker; (3) local access with at least unprivileged user rights (CVSS PR:L), as the attack vector is purely local (CVSS AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the local-only attack surface but the C:H/I:H impact assumption depends on whether the underflow yields a writable heap primitive - which is plausible but not demonstrated by available data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to a patched kernel release: 6.12.109, 6.18.50, 7.2.4, or any build from 7.3-rc1 onward. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory systems using eCryptfs and assess which allow local user access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today