Out-of-bounds read in Linux kernel - CVE-2026-74567

Vulnerability details

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in keyring_get_key_chunk() when processing crafted colliding key descriptions through add_key(2). A local user can add a crafted pair of same-type keys whose index hashes collide to disclose sensitive information.

The issue is triggered when the lookup reaches a description-level chunk after collisions through the hash, x, type, and domain_tag chunks.

Affected software

How to mitigate CVE-2026-74567

External References

• https://git.kernel.org/stable/c/3a744838453fb9309ce5a5526d3252e211d60152
• https://git.kernel.org/stable/c/63918731f9ae25b5deb022f118e941e6dddfcef4
• https://git.kernel.org/stable/c/8dba33c1e779d0fb9a2acb31e354cf0fc0229111
• https://git.kernel.org/stable/c/d1933e03e8c74a018550c31a393b79c4d95bff40
• https://git.kernel.org/stable/c/e9417d21a22ad2ec398e78fcf084b717ce92cf2f

Related Security Bulletins

• Out-of-bounds read in Linux kernel keys
• Debian update for linux