CVE-2026-74567

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> keys: fix out-of-bounds read in keyring_get_key_chunk()<br /> <br /> For description-level chunks keyring_get_key_chunk() advances the read<br /> pointer by level * sizeof(long) past the inline prefix but only<br /> bounds-checks the prefix, so a long enough key description is read past<br /> its kmemdup(desc, desc_len + 1) allocation. Compute the full byte<br /> offset and bounds-check the description against it before reading.<br /> <br /> The walk only reaches a description-level chunk when two keys collide<br /> through the hash, x, type and domain_tag chunks, so this is reached from<br /> an unprivileged add_key(2) with a crafted pair of same-type keys whose<br /> index hashes collide; KASAN reports a slab-out-of-bounds read.