CVE-2026-89607 (GCVE-0-2026-89607)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-14 12:01
VLAI
Title
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
Summary
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet parse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body without bounding it against ECRYPTFS_MAX_KEY_BYTES (64). When encrypted_key_size > 64, decrypt_passphrase_encrypted_session_key() sets decrypted_key_size = encrypted_key_size and performs two out-of-bounds writes: 1. crypto_skcipher_decrypt() writes encrypted_key_size bytes into decrypted_key[64] via scatterlist, overflowing into the parent ecryptfs_auth_tok struct. 2. memcpy(crypt_stat->key, decrypted_key, decrypted_key_size) writes into crypt_stat->key[64], corrupting root_iv, keysig_list, and mutexes in ecryptfs_crypt_stat. Only AES-192 (cipher code 0x08) enables this because it sets crypt_stat->key_size = 24 independently of encrypted_key_size, allowing crypto_skcipher_setkey() to succeed while encrypted_key_size exceeds ECRYPTFS_MAX_KEY_BYTES. The PKI decryption path (parse_tag_65_packet) already validates decrypted_key_size <= ECRYPTFS_MAX_KEY_BYTES; the passphrase path omits this check. Bound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64) rather than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES (512). The 64-byte limit also protects the 512-byte encrypted_key[] buffer, so the former 512-byte check is removed as redundant. [tyhicks: Adjust the code comment to refer to macros representing the buffer sizes rather than mentioning the buffer size values since they may change in the future]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 237fead619984cc48818fe12ee0ceada3f55b012 , < 2cd21340163494d312836c77c9fbfe2530b3d075 (git)
Affected: 237fead619984cc48818fe12ee0ceada3f55b012 , < e2152d491ae62d96a32ed59778680a242af1fbc6 (git)
Affected: 237fead619984cc48818fe12ee0ceada3f55b012 , < d2802414081184f79a619ede178aeef3aa989793 (git)
Affected: 237fead619984cc48818fe12ee0ceada3f55b012 , < 33e050cac841498b5175f0f385eee903fd98863c (git)
Affected: 237fead619984cc48818fe12ee0ceada3f55b012 , < ccd13eff0e7356d2aa28b127b577e4e5ad4563f5 (git)
Affected: 237fead619984cc48818fe12ee0ceada3f55b012 , < 14cb36a500a5a3afbc955dbf69dabc565f1a3b26 (git)
Affected: 237fead619984cc48818fe12ee0ceada3f55b012 , < a419c9ebfc9a40ee56aaad6dc68bfd67d400817b (git)
Affected: 237fead619984cc48818fe12ee0ceada3f55b012 , < 5babe9c177c364521e3e682b949c5a8c47f4a441 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.19
Unaffected: 0 , < 2.6.19 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ecryptfs/keystore.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2cd21340163494d312836c77c9fbfe2530b3d075",
              "status": "affected",
              "version": "237fead619984cc48818fe12ee0ceada3f55b012",
              "versionType": "git"
            },
            {
              "lessThan": "e2152d491ae62d96a32ed59778680a242af1fbc6",
              "status": "affected",
              "version": "237fead619984cc48818fe12ee0ceada3f55b012",
              "versionType": "git"
            },
            {
              "lessThan": "d2802414081184f79a619ede178aeef3aa989793",
              "status": "affected",
              "version": "237fead619984cc48818fe12ee0ceada3f55b012",
              "versionType": "git"
            },
            {
              "lessThan": "33e050cac841498b5175f0f385eee903fd98863c",
              "status": "affected",
              "version": "237fead619984cc48818fe12ee0ceada3f55b012",
              "versionType": "git"
            },
            {
              "lessThan": "ccd13eff0e7356d2aa28b127b577e4e5ad4563f5",
              "status": "affected",
              "version": "237fead619984cc48818fe12ee0ceada3f55b012",
              "versionType": "git"
            },
            {
              "lessThan": "14cb36a500a5a3afbc955dbf69dabc565f1a3b26",
              "status": "affected",
              "version": "237fead619984cc48818fe12ee0ceada3f55b012",
              "versionType": "git"
            },
            {
              "lessThan": "a419c9ebfc9a40ee56aaad6dc68bfd67d400817b",
              "status": "affected",
              "version": "237fead619984cc48818fe12ee0ceada3f55b012",
              "versionType": "git"
            },
            {
              "lessThan": "5babe9c177c364521e3e682b949c5a8c47f4a441",
              "status": "affected",
              "version": "237fead619984cc48818fe12ee0ceada3f55b012",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ecryptfs/keystore.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.19"
            },
            {
              "lessThan": "2.6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\necryptfs: reject oversized encrypted_key_size in parse_tag_3_packet\n\nparse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body\nwithout bounding it against ECRYPTFS_MAX_KEY_BYTES (64). When\nencrypted_key_size \u003e 64, decrypt_passphrase_encrypted_session_key()\nsets decrypted_key_size = encrypted_key_size and performs two\nout-of-bounds writes:\n\n1. crypto_skcipher_decrypt() writes encrypted_key_size bytes into\n   decrypted_key[64] via scatterlist, overflowing into the parent\n   ecryptfs_auth_tok struct.\n2. memcpy(crypt_stat-\u003ekey, decrypted_key, decrypted_key_size) writes\n   into crypt_stat-\u003ekey[64], corrupting root_iv, keysig_list, and\n   mutexes in ecryptfs_crypt_stat.\n\nOnly AES-192 (cipher code 0x08) enables this because it sets\ncrypt_stat-\u003ekey_size = 24 independently of encrypted_key_size,\nallowing crypto_skcipher_setkey() to succeed while encrypted_key_size\nexceeds ECRYPTFS_MAX_KEY_BYTES.\n\nThe PKI decryption path (parse_tag_65_packet) already validates\ndecrypted_key_size \u003c= ECRYPTFS_MAX_KEY_BYTES; the passphrase path\nomits this check.\n\nBound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64) rather\nthan ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES (512). The 64-byte limit also\nprotects the 512-byte encrypted_key[] buffer, so the former 512-byte\ncheck is removed as redundant.\n\n[tyhicks: Adjust the code comment to refer to macros representing the\n buffer sizes rather than mentioning the buffer size values since they\n may change in the future]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggered by a local open/setattr on an eCryptfs mount: ecryptfs_open -\u003e read_or_initialize_metadata -\u003e ecryptfs_read_metadata parses attacker-supplied Tag 3 packets from the lower file header (or xattr). The kernel does not process this as network protocol data.\nAC:L - The attacker fully controls the Tag 3 body, including AES-192 cipher code 0x08 and an AES-block-aligned encrypted_key_size of 80-512 bytes. decrypt_passphrase_encrypted_session_key() then overflows deterministically; no race or uninfluenced memory layout is required to trigger the writes.\nPR:L - An unprivileged user reaches this on standard eCryptfs deployments (setuid-root mount.ecryptfs_private and per-user encrypted home/Private). They plant a crafted lower file under their own .Private directory and open it through the already-mounted eCryptfs tree; init-namespace root is not required.\nUI:N - The attacker performs the whole sequence themselves: install a matching passphrase auth token, write the malformed Tag 3/Tag 11 header into their lower directory, and open the file. No action by another user is required.\nS:U - The out-of-bounds writes corrupt kernel heap and eCryptfs inode-private objects in the same kernel security authority. This is local privilege escalation, not a VM, IOMMU, or sandbox boundary crossing.\nC:H - crypto_skcipher_decrypt() and memcpy() write tens to hundreds of bytes past decrypted_key[64] and crypt_stat-\u003ekey[64], overflowing into reserved/token fields, keysig_list, mutexes, and adjacent slab/inode-cache objects. That heap corruption can be groomed into an arbitrary kernel read.\nI:H - Session-key wrap uses AES-ECB with the attacker\u0027s known passphrase-derived key, so the overflow payload is chosen plaintext. Up to 448 bytes past the 64-byte buffers corrupt list_head pointers and neighboring slab objects, yielding a write primitive for control-flow hijack.\nA:H - Corrupting keysig_list, embedded mutexes, and adjacent inode-cache/slab objects causes kernel oops or panic. The attacker can open the crafted file repeatedly to crash the system at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:27.820Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2cd21340163494d312836c77c9fbfe2530b3d075"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2152d491ae62d96a32ed59778680a242af1fbc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2802414081184f79a619ede178aeef3aa989793"
        },
        {
          "url": "https://git.kernel.org/stable/c/33e050cac841498b5175f0f385eee903fd98863c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ccd13eff0e7356d2aa28b127b577e4e5ad4563f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/14cb36a500a5a3afbc955dbf69dabc565f1a3b26"
        },
        {
          "url": "https://git.kernel.org/stable/c/a419c9ebfc9a40ee56aaad6dc68bfd67d400817b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5babe9c177c364521e3e682b949c5a8c47f4a441"
        }
      ],
      "title": "ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89607",
    "datePublished": "2026-09-11T19:45:09.583Z",
    "dateReserved": "2026-09-11T19:38:34.733Z",
    "dateUpdated": "2026-09-14T12:01:27.820Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89607",
      "date": "2026-09-20",
      "epss": "0.00164",
      "percentile": "0.0604"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-15T01:45:32.000Z",
      "cve": "CVE-2026-89607",
      "id": "msrc_CVE-2026-89607",
      "initial_release_date": "2026-09-13T01:10:12.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89607.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ecryptfs/keystore.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2cd21340163494d312836c77c9fbfe2530b3d075",
                    "status": "affected",
                    "version": "237fead619984cc48818fe12ee0ceada3f55b012",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e2152d491ae62d96a32ed59778680a242af1fbc6",
                    "status": "affected",
                    "version": "237fead619984cc48818fe12ee0ceada3f55b012",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d2802414081184f79a619ede178aeef3aa989793",
                    "status": "affected",
                    "version": "237fead619984cc48818fe12ee0ceada3f55b012",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "33e050cac841498b5175f0f385eee903fd98863c",
                    "status": "affected",
                    "version": "237fead619984cc48818fe12ee0ceada3f55b012",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ccd13eff0e7356d2aa28b127b577e4e5ad4563f5",
                    "status": "affected",
                    "version": "237fead619984cc48818fe12ee0ceada3f55b012",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "14cb36a500a5a3afbc955dbf69dabc565f1a3b26",
                    "status": "affected",
                    "version": "237fead619984cc48818fe12ee0ceada3f55b012",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a419c9ebfc9a40ee56aaad6dc68bfd67d400817b",
                    "status": "affected",
                    "version": "237fead619984cc48818fe12ee0ceada3f55b012",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5babe9c177c364521e3e682b949c5a8c47f4a441",
                    "status": "affected",
                    "version": "237fead619984cc48818fe12ee0ceada3f55b012",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ecryptfs/keystore.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.19"
                  },
                  {
                    "lessThan": "2.6.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\necryptfs: reject oversized encrypted_key_size in parse_tag_3_packet\n\nparse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body\nwithout bounding it against ECRYPTFS_MAX_KEY_BYTES (64). When\nencrypted_key_size \u003e 64, decrypt_passphrase_encrypted_session_key()\nsets decrypted_key_size = encrypted_key_size and performs two\nout-of-bounds writes:\n\n1. crypto_skcipher_decrypt() writes encrypted_key_size bytes into\n   decrypted_key[64] via scatterlist, overflowing into the parent\n   ecryptfs_auth_tok struct.\n2. memcpy(crypt_stat-\u003ekey, decrypted_key, decrypted_key_size) writes\n   into crypt_stat-\u003ekey[64], corrupting root_iv, keysig_list, and\n   mutexes in ecryptfs_crypt_stat.\n\nOnly AES-192 (cipher code 0x08) enables this because it sets\ncrypt_stat-\u003ekey_size = 24 independently of encrypted_key_size,\nallowing crypto_skcipher_setkey() to succeed while encrypted_key_size\nexceeds ECRYPTFS_MAX_KEY_BYTES.\n\nThe PKI decryption path (parse_tag_65_packet) already validates\ndecrypted_key_size \u003c= ECRYPTFS_MAX_KEY_BYTES; the passphrase path\nomits this check.\n\nBound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64) rather\nthan ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES (512). The 64-byte limit also\nprotects the 512-byte encrypted_key[] buffer, so the former 512-byte\ncheck is removed as redundant.\n\n[tyhicks: Adjust the code comment to refer to macros representing the\n buffer sizes rather than mentioning the buffer size values since they\n may change in the future]"
          }
        ],
        "id": "CVE-2026-89607",
        "lastModified": "2026-09-14T13:19:14.910",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:45.723",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/14cb36a500a5a3afbc955dbf69dabc565f1a3b26"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2cd21340163494d312836c77c9fbfe2530b3d075"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/33e050cac841498b5175f0f385eee903fd98863c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5babe9c177c364521e3e682b949c5a8c47f4a441"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a419c9ebfc9a40ee56aaad6dc68bfd67d400817b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ccd13eff0e7356d2aa28b127b577e4e5ad4563f5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d2802414081184f79a619ede178aeef3aa989793"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e2152d491ae62d96a32ed59778680a242af1fbc6"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-15T09:42:44+00:00",
      "cve": "CVE-2026-89607",
      "id": "CVE-2026-89607",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "262",
      "product_status:under_investigation": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89607.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-13T16:58:10Z",
      "cve": "CVE-2026-89607",
      "id": "CVE-2026-89607",
      "initial_release_date": "2026-09-12T16:25:13Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89607",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89607.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.