CVE-2026-74567

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The flaw is reached only through local key-management syscalls (add_key, keyctl link/search) that walk the keyring assoc_array in security/keys/keyring.c; the keys subsystem has no network-facing handler or remote packet path.

AC:LAttack complexity, low

An attacker fully controls both key descriptions and can offline-compute a same-type pair whose index collides through hash, x, type and domain_tag yet differs later, deterministically forcing description-level chunks without races or uncontrollable layout.

PR:LPrivileges required, low

The fix commit and add_key path confirm any unprivileged local user can add crafted keys to their own session/user keyring (lookup_user_key with KEY_NEED_WRITE); no real-root capability or init-namespace privilege is required.

UI:NUser interaction, none

Exploitation is self-contained: the attacker issues add_key twice with crafted colliding descriptions into a writable keyring they own; no action by another user or administrator is required.

S:UScope, unchanged

The out-of-bounds slab read and any disclosed data remain within the host kernel's security authority; this is standard local kernel memory access, not a VM escape, IOMMU bypass, or sandbox boundary crossing.

C:HConfidentiality impact, high

keyring_get_key_chunk() reads up to a word past the kmemdup(desc,desc_len+1) allocation when the offset includes level*sizeof(long), yielding an adjacent-heap read primitive that can disclose kernel pointers and other sensitive slab contents.

I:NIntegrity impact, none

This is a read-only out-of-bounds access with no kernel memory write, type confusion, or control-flow hijack; the bug discloses data but does not directly modify kernel or victim integrity.

A:HAvailability impact, high

KASAN reports slab-out-of-bounds on trigger, and reading beyond the description allocation can fault at slab/page boundaries; the add_key insertion path is trivially repeatable for denial-of-service.