Linux KEYS: miscalculated output buffer length overflows on keyctl asymmetric key operations

Impact

The internal output buffer for keyctl public-key operations was sized from a bad calculation, so a caller that supplies a buffer smaller than the cryptographic primitive's output causes an overflow inside the kernel. The fix stops trusting the caller-supplied size and allocates for the maximum primitive length. This is reachable by any local user through the keyctl() asymmetric key interface, which nodes use for module signing keys, IMA and trusted-key workflows. No exploitation detail is in the record beyond the overflow itself. Separate flaw from the request_key_auth refcount bug published the same day - different code path, different fix.

Who can reach it

Local unprivileged user calling keyctl() public-key operations with an undersized output buffer. No GPU or device access needed; no remote path.

What to do

Update to a stable kernel carrying the corrected allocation in keyctl_pkey_params_get_2(). No published workaround; blocking keyctl() via seccomp is the only mitigation and breaks legitimate key users. Pick the fix up with the distro kernel and reboot each node.

References

Related entries

• Linux arm64: stale page-table entry left in the walk cache when a hugetlb PMD table is unsharedCVE-2026-63875 · Linux kernel arm64 TLB maintenance (tlb_flush on hugetlb PMD unshare)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-63881 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2026-63884 · Linux i915 GPU kernel driverHigh
• Linux kernel (net/xfrm): Cloning an IPTFS security association kmemdups the mode data, so the clone shares the originalCVE-2026-63911 · Linux kernel (net/xfrm)High
• Linux kernel (net/smc): The SMC socket hashtables are re-initialised at the end of module init, after the protocol andCVE-2026-64005 · Linux kernel (net/smc)High
• Linux kernel (net/xfrm): An unprivileged user who can create IPsec SAs turns one outbound datagram into a multi-exabyteCVE-2026-64009 · Linux kernel (net/xfrm)High