« Volver al listado

CVE-2026-89606

Estado: RecibidaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

ecryptfs: reject too-small tag 70 packets

ecryptfs_parse_tag_70_packet() subtracts fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixed fields can underflow that size calculation.

Reject tag 70 packets before the subtraction unless the body contains the signature, cipher code, and at least one byte of encrypted filename data.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de underflow en kernel local (AV:L, PR:L) que permite escalada de privilegios en ecryptfs. Impacto de ejecución de código y corrupción de datos en el filesystem.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data Storage

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89606",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "9c79f34f7ee71cd28272332b424ca64b2be006ab",
              "lessThan": "df5f375a6151ef71f636da044bcef90c26697255",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9c79f34f7ee71cd28272332b424ca64b2be006ab",
              "lessThan": "5668121974eb7f7aa82793a9d0d13abadb8904dc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9c79f34f7ee71cd28272332b424ca64b2be006ab",
              "lessThan": "2e5afed9503dd1d85004c09503adc2cb584c0188",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9c79f34f7ee71cd28272332b424ca64b2be006ab",
              "lessThan": "414a0f04feb06f03523edf7e2a8be1d7f1a9b160",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9c79f34f7ee71cd28272332b424ca64b2be006ab",
              "lessThan": "9d88391bbed76eb091cddd50b0af87b1c6f22589",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9c79f34f7ee71cd28272332b424ca64b2be006ab",
              "lessThan": "b31da1ecf13929a8d7f8d2727843d2fe35396b75",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9c79f34f7ee71cd28272332b424ca64b2be006ab",
              "lessThan": "d2869768eab5648e6edc05f47e0716e5328e6681",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9c79f34f7ee71cd28272332b424ca64b2be006ab",
              "lessThan": "e97bbe1b2bd82ec2ae37ad2e4965b4d3e78bbf7f",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/ecryptfs/keystore.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.29",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/ecryptfs/keystore.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:45.603",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2e5afed9503dd1d85004c09503adc2cb584c0188",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/414a0f04feb06f03523edf7e2a8be1d7f1a9b160",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5668121974eb7f7aa82793a9d0d13abadb8904dc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9d88391bbed76eb091cddd50b0af87b1c6f22589",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b31da1ecf13929a8d7f8d2727843d2fe35396b75",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d2869768eab5648e6edc05f47e0716e5328e6681",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/df5f375a6151ef71f636da044bcef90c26697255",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e97bbe1b2bd82ec2ae37ad2e4965b4d3e78bbf7f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\necryptfs: reject too-small tag 70 packets\n\necryptfs_parse_tag_70_packet() subtracts fixed metadata fields from the\nparsed packet body size to derive the encrypted filename size.  A\nmalformed packet with a body smaller than those fixed fields can underflow\nthat size calculation.\n\nReject tag 70 packets before the subtraction unless the body contains the\nsignature, cipher code, and at least one byte of encrypted filename data."
    }
  ],
  "lastModified": "2026-09-14T13:19:14.747",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}