CVE-2026-98222

What it actually does

Integer overflow in encrypted_key_alloc() truncates datablob_len and key->datalen to u16, resulting in undersized kzalloc and subsequent slab-out-of-bounds write when copying master key material.

Why it matters to the business

Local attackers can corrupt kernel memory, potentially leading to privilege escalation or denial of service on any system using the encrypted keys subsystem; the flaw affects the core Linux kernel so impact is widespread across servers, containers, and embedded devices.

How an attack unfolds

An attacker with the ability to create or load an encrypted key supplies crafted payload and description lengths whose sum exceeds 65535; the truncated allocation size causes __ekey_init() to write beyond the buffer, triggering KASAN-detected out-of-bounds access that can be turned into arbitrary kernel write.

How to fix it

Upgrade to a kernel containing the fix that replaces direct length calculations with check_add_overflow() and uses kzalloc_flex() for the flexible array; apply the vendor-supplied patch or newer mainline release that enforces proper size checks before allocation.

How to confirm the fix worked

Confirm the running kernel source contains the check_add_overflow() guard and kzalloc_flex() call in encrypted_key_alloc(); recompile and boot-test with a synthetic key whose total length exceeds U16_MAX to verify rejection rather than truncation.

Typical attack path

1. Obtain local code execution or shell on target system
2. Invoke add_key() or keyctl() with encrypted key type and oversized description/payload
3. Trigger integer overflow in datablob_len calculation
4. Cause undersized allocation and subsequent out-of-bounds write
5. Leverage resulting memory corruption for privilege escalation

How to detect it

Review kernel audit logs and KASAN reports for slab-out-of-bounds writes originating from __ekey_init() or encrypted_key_alloc(); correlate with keyctl or add_key system-call records showing unusually large description or payload arguments.

What your security team should do

• Prioritize kernel updates on all systems that compile or run the encrypted keys module
• Restrict unprivileged key creation via keyctl and user namespaces where possible
• Monitor for future CVEs in the KEYS subsystem given repeated integer-handling issues
• Include kernel version checks in vulnerability scanning pipelines