CVE-2026-89608
High · 7.1CVSS
7.1
EPSS
0.2%
Published
Sep 11, 2026
CISA due date
—
Cloudanix analysis
A flaw in how the Linux kernel handles certain encrypted file systems could let someone already logged into the computer peek at private data or cause crashes.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Improper Input Validation
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Incorrect buffer size calculation in ecryptfs_parse_packet_set() uses PAGE_SIZE-8 instead of the actual remaining packet length for version 1 headers, allowing reads past the supplied buffer during tag 3 and tag 11 packet parsing.
Why it matters to the business
A local user on an affected Linux system can potentially read kernel memory contents or trigger crashes, risking data exposure and service disruption; the issue has been public for over six weeks with very low observed exploitation probability.
How an attack unfolds
An attacker with local access crafts or supplies a malicious ecryptfs filesystem image containing version 1 headers with oversized packet sets; when the kernel parses the image, the overstated buffer length leads to out-of-bounds memory access during packet tag processing.
How to fix it
Update the Linux kernel to a version containing the corrected ecryptfs_parse_packet_set() implementation that receives and uses the actual packet set buffer length from the caller; rebuild and reboot with the patched kernel.
How to confirm the fix worked
Confirm the kernel source contains the updated function signature and length calculations based on the passed buffer size rather than PAGE_SIZE-8; test by attempting to mount a version-1 ecryptfs image and verify no out-of-bounds access occurs.
Typical attack path
- Obtain local user access on target Linux system
- Prepare ecryptfs volume header with version 1 format and manipulated packet lengths
- Mount or trigger parsing of the crafted image via ecryptfs
- Trigger buffer over-read during tag 3/tag 11 parsing
How to detect it
Review kernel logs and audit records for ecryptfs mount or parse failures around the time of suspicious local activity; look for unusual memory access or oops reports tied to ecryptfs packet parsing.
What your security team should do
- Prioritize kernel updates for systems using ecryptfs
- Audit for ecryptfs usage in production workloads
- Monitor vendor advisories for the specific fixed kernel releases
The record
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfs_parse_packet_set() receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGE_SIZE - 8. For version 1 headers the packet set starts later in the header, so this can overstate the available buffer. Pass the actual packet set buffer length from the caller and calculate per-packet limits from the remaining bytes in that buffer. Recompute the remaining length after consuming a tag 3 packet before parsing the following tag 11 packet.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|