Linux kernel: integer overflow in asymmetric_key_generate_id can overflow a key-id buffer

Impact

asymmetric_key_generate_id adds caller-supplied blob lengths to the size of an asymmetric_key_id structure without overflow checking, so arbitrarily large X.509 fields - ASN.1 INTEGER serial numbers, issuer names - can wrap the computation and overflow the copy. This is reached wherever the kernel parses certificates into the keyring: module signature verification, IMA/EVM appraisal, kexec image signatures, and dm-verity key loading. On a GPU node that means the certificate-parsing path sitting under out-of-tree driver module loading, which is exactly the path that runs at boot and on every driver reinstall. The fix returns -EOVERFLOW instead; the record gives no evidence of remote reachability, and triggering it needs a local path that feeds an attacker-chosen certificate into the kernel.

Who can reach it

Local, authenticated: a user or process able to submit an attacker-crafted X.509 certificate to a kernel keyring or signature-verification path. Not reachable from the network in a default server configuration.

What to do

Take the stable kernel updates carrying the check_add_overflow() fix (five stable branches have backports). Kernel package upgrade means a node reboot: drain the GPU node, let running jobs finish or checkpoint, then reboot - the usual expensive part on a fleet where a node holds long training runs. No mitigation short of patching is described; the only reduction in exposure is limiting who can load certificates into kernel keyrings.

References

Related entries

• Linux kernel (virt/kvm): KVM blocked turning KVM_MEM_GUEST_MEMFD on for an existing memslot but not turning it off, andCVE-2025-68810 · Linux kernel (virt/kvm)High
• Linux kernel on POWER hash MMU: stale hardware SLB entries cause an SLB multi-hit machine checkCVE-2025-71078 · Linux kernel powerpc/64s SLB preload cache (hash MMU)High
• Linux kernel (drivers/iommu): In an SVA context the IOMMU walks and caches the CPU's page tables, and on x86 everyCVE-2025-71089 · Linux kernel (drivers/iommu)High
• Linux kernel (drivers/gpu/drm/xe): The observation-config ioctl dereferences the config object after releasing the lockCVE-2025-71099 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel qla2xxx: double free in bsg_done() on the Fibre Channel passthrough error pathCVE-2025-71238 · Linux kernel qla2xxx (QLogic Fibre Channel HBA bsg passthrough)High
• OpenSSH ssh client: shell metacharacters in a command-line username allow injectionCVE-2026-106583 · OpenSSH ssh client (command-line username handling)High