{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet  parse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body without bounding it against ECRYPTFS_MAX_KEY_BYTES (64). When encrypted_key_size \u003e 64, decrypt_passphrase_encrypted_session_key() sets decrypted_key_size = encrypted_key_size and performs two out-of-bounds writes:  1. crypto_skcipher_decrypt() writes encrypted_key_size bytes into    decrypted_key[64] via scatterlist, overflowing into the parent    ecryptfs_auth_tok struct. 2. memcpy(crypt_stat-\u003ekey, decrypted_key, decrypted_key_size) writes    into crypt_stat-\u003ekey[64], corrupting root_iv, keysig_list, and    mutexes in ecryptfs_crypt_stat.  Only AES-192 (cipher code 0x08) enables this because it sets crypt_stat-\u003ekey_size = 24 independently of encrypted_key_size, allowing crypto_skcipher_setkey() to succeed while encrypted_key_size exceeds ECRYPTFS_MAX_KEY_BYTES.  The PKI decryption path (parse_tag_65_packet) already validates decrypted_key_size \u003c= ECRYPTFS_MAX_KEY_BYTES; the passphrase path omits this check.  Bound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64) rather than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES (512). The 64-byte limit also protects the 512-byte encrypted_key[] buffer, so the former 512-byte check is removed as redundant.  [tyhicks: Adjust the code comment to refer to macros representing the  buffer sizes rather than mentioning the buffer size values since they  may change in the future]",
  "id": "DEBIAN-CVE-2026-89607",
  "modified": "2026-09-14T08:47:44.987155924Z",
  "published": "2026-09-11T20:19:45.723Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-89607"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-89607"
  ]
}