CVE-2026-89608: ecryptfs: pass packet set buffer size to parser
In the Linux kernel, the following vulnerability has been resolved:
ecryptfs: pass packet set buffer size to parser
ecryptfsparsepacketset() receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGESIZE - 8. For version 1 headers the packet set starts later in the header, so this can overstate the available buffer.
Pass the actual packet set buffer length from the caller and calculate per-packet limits from the remaining bytes in that buffer. Recompute the remaining length after consuming a tag 3 packet before parsing the following tag 11 packet.
Affected Software
Event History
Frequently Asked Questions
Are all eCryptfs header formats affected?
The issue specifically concerns version 1 headers, where the packet set begins later in the file header than the parser's prior buffer calculation assumed.
What packet layout is relevant when assessing exposure?
The fix recomputes the remaining packet-set length after a tag 3 packet before parsing a following tag 11 packet. This sequence is explicitly addressed by the corrected bounds handling.