CVE-2026-89607: Linux Kernel eCryptfs Buffer Overflow

CVE-2026-89607 Overview

CVE-2026-89607 is an out-of-bounds write vulnerability in the Linux kernel's eCryptfs subsystem. The flaw resides in the parse_tag_3_packet() function, which fails to bound encrypted_key_size against the ECRYPTFS_MAX_KEY_BYTES (64-byte) limit when parsing a Tag 3 packet. A local attacker who can supply a crafted eCryptfs packet triggers two out-of-bounds writes that corrupt the parent ecryptfs_auth_tok structure and the ecryptfs_crypt_stat structure, including root_iv, keysig_list, and kernel mutexes.

Critical Impact
Local attackers can corrupt kernel memory structures through the eCryptfs passphrase decryption path, enabling privilege escalation or kernel compromise on systems that mount eCryptfs volumes.

Affected Products

Linux kernel — eCryptfs subsystem (multiple stable branches, per referenced commits)
Distributions shipping eCryptfs with AES-192 cipher support enabled
Systems that mount user-controlled or untrusted eCryptfs volumes

Discovery Timeline

2026-09-11 - CVE-2026-89607 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89607

Vulnerability Analysis

The vulnerability lives in the passphrase decryption path of eCryptfs. parse_tag_3_packet() reads encrypted_key_size directly from the Tag 3 packet body without validating it against ECRYPTFS_MAX_KEY_BYTES (64). When encrypted_key_size > 64, decrypt_passphrase_encrypted_session_key() assigns decrypted_key_size = encrypted_key_size and proceeds with decryption using a fixed 64-byte destination buffer.

Two distinct out-of-bounds writes result. First, crypto_skcipher_decrypt() writes encrypted_key_size bytes into the 64-byte decrypted_key[] array via scatterlist, overflowing into the enclosing ecryptfs_auth_tok structure. Second, memcpy(crypt_stat->key, decrypted_key, decrypted_key_size) writes beyond the 64-byte crypt_stat->key[] array, corrupting adjacent fields including root_iv, keysig_list, and kernel mutex objects in ecryptfs_crypt_stat.

Corrupting kernel mutexes and structure pointers creates conditions for privilege escalation, arbitrary kernel memory writes, or system compromise.

Root Cause

The root cause is a missing input validation check on attacker-controlled length fields parsed from an on-disk packet format. The PKI decryption path in parse_tag_65_packet already validates decrypted_key_size <= ECRYPTFS_MAX_KEY_BYTES, but the passphrase path omitted the equivalent check. This is an Out-of-Bounds Write [CWE-787] class defect.

Attack Vector

Only the AES-192 cipher (cipher code 0x08) reaches the vulnerable code path. AES-192 sets crypt_stat->key_size = 24 independently of encrypted_key_size, allowing crypto_skcipher_setkey() to succeed even when encrypted_key_size exceeds the 64-byte limit. A local attacker mounts or supplies an eCryptfs volume containing a crafted Tag 3 packet with an oversized encrypted_key_size field. When the kernel parses the packet during key derivation, the out-of-bounds writes corrupt adjacent kernel structures.

No verified public exploit code is available. The upstream patch bounds encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64) rather than the previously used ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES (512), and removes the now-redundant 512-byte check. See the Kernel Commit Change Log for the fix.

Detection Methods for CVE-2026-89607

Indicators of Compromise

Unexpected kernel oops, panics, or mutex-related warnings originating in fs/ecryptfs/keystore.c or fs/ecryptfs/crypto.c.
Mount operations of eCryptfs volumes originating from unprivileged users or untrusted sources.
Kernel log entries referencing parse_tag_3_packet, decrypt_passphrase_encrypted_session_key, or memory corruption in ecryptfs_auth_tok.

Detection Strategies

Audit installed kernel packages against fixed versions listed in the referenced stable-tree commits.
Enable kernel address sanitizer (KASAN) in test environments to surface the out-of-bounds writes during eCryptfs mount testing.
Monitor auditd for mount syscalls specifying type=ecryptfs executed by non-root or unexpected principals.

Monitoring Recommendations

Forward kernel logs (dmesg, /var/log/kern.log) to a centralized log platform and alert on eCryptfs error strings.
Track process execution of mount.ecryptfs and ecryptfs-mount-private for anomalous invocations.
Correlate eCryptfs mount events with subsequent kernel instability or privilege changes on the same host.

How to Mitigate CVE-2026-89607

Immediate Actions Required

Apply vendor kernel updates that include the patched parse_tag_3_packet() bounds check.
Inventory hosts using eCryptfs (commonly Ubuntu encrypted home directories and ecryptfs-utils deployments) and prioritize patching.
Restrict the ability of untrusted users to mount arbitrary eCryptfs volumes.

Patch Information

The fix bounds encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES in parse_tag_3_packet() and removes the redundant 512-byte check. Patched commits are available across multiple stable branches: commit 33e050c, commit 14cb36a, commit 2cd2134, commit 5babe9c, commit a419c9e, commit ccd13ef, commit d280241, and commit e2152d4.

Workarounds

Unmount and disable eCryptfs on systems that do not require it, and remove or blacklist the ecryptfs kernel module.
Prevent non-root users from mounting eCryptfs volumes by tightening sudo and PAM configurations for mount.ecryptfs.
Avoid deploying eCryptfs configurations that select the AES-192 cipher until the patched kernel is installed.

bash

# Blacklist the ecryptfs kernel module until patched kernel is deployed
echo 'blacklist ecryptfs' | sudo tee /etc/modprobe.d/disable-ecryptfs.conf
sudo update-initramfs -u

# Verify running kernel version and reboot after applying vendor updates
uname -r
sudo apt list --installed 2>/dev/null | grep linux-image