Linux kernel encrypted keys: u16 truncation of datablob_len gives a slab out-of-bounds write

Impact

datablob_len is stored in a u16 but computed from attacker-chosen description and payload lengths, so a blob longer than 64 KiB truncates the allocation while __ekey_init() still copies the full master key description in. KASAN shows a 32760-byte slab out-of-bounds write, which is a heap corruption primitive an unprivileged local process can drive from the add_key path - the usual road to local privilege escalation. On a shared GPU node any tenant with shell or code execution inside a pod that is not blocking the keyctl/add_key syscalls can reach it, and a successful escalation to host root means every other tenant's GPUs and data on that node are exposed. The record is a stable-tree fix with no CVSS score or exploit detail.

Who can reach it

Local, unauthenticated beyond having the ability to run code: any local user or container process that can call add_key() with the "encrypted" key type and oversized description/payload. No privileges and no device access are needed; seccomp or LSM policy that blocks keyring syscalls removes the path.

What to do

Take the stable kernel update carrying the check_add_overflow()/kzalloc_flex() fix in encrypted_key_alloc(), then drain and reboot each node - this is core kernel code with no module reload or live-patch path published in the record. As an interim mitigation, deny the add_key/keyctl syscalls or the "encrypted" key type to untrusted workloads via seccomp profiles. The record does not name a fixed release version, only the stable commits.

References

Related entries

• Linux kernel SCSI core: unvalidated MODE SENSE lengths leak stack memory to the storage deviceCVE-2026-98232 · Linux kernel SCSI core (scsi_cdl_enable MODE SENSE length validation)Unscored
• Linux kernel dma-buf: 32-bit mapped_len truncates peer-to-peer DMA mappings larger than 4 GiBCVE-2026-98242 · Linux kernel dma-buf (phys vec to scatterlist conversion, mapped_len overflow)Unscored
• Linux kernel dma-fence: lost RCU protection after signalling allows use-after-free of fence name stringsCVE-2026-98243 · Linux kernel dma-buf/dma-fence (timeline and driver name accessors)Unscored
• Linux kernel arm64: LSE percpu ops on 8/16-bit types read and write 32 bits of memoryCVE-2026-98248 · Linux kernel arm64 percpu operations (LSE atomics on 8- and 16-bit types)Unscored
• Linux kernel RDMA/core: iWARP port mapper initialises its refcount after publishing the requestCVE-2026-98252 · Linux kernel RDMA/core iWARP port mapper (iwpm_get_nlmsg_request refcount init)Unscored
• Linux kernel perf: NULL pmu dereference when a PMU module unloads with an event openCVE-2026-98268 · Linux kernel perf (is_include_guest_event / mediated PMU accounting)Unscored