{"id":"CVE-2026-63824","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: fix overflow in keyctl_pkey_params_get_2()\n\nThe length for the internal output buffer is calculated incorrectly, which\ncan result overflow when a too small buffer…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: fix overflow in keyctl_pkey_params_get_2()\n\nThe length for the internal output buffer is calculated incorrectly, which\ncan result overflow when a too small buffer…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","published":"2026-07-19","updated":"2026-08-17","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63824","references":[{"url":"https://git.kernel.org/stable/c/0f3058d7d26f81df9b68a18ddbe164bdc3c5eff3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5165f1cc727f1322456735df212d8e26ec237a8d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5966e4e2ba213ab7ad559166152eb4f1f170dd2c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/622ec2dcd59f21623f2a7ab773c80ceb7d555e3a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/670fc6a311ed321522b7fff92cf0fc376b4f6e78","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b11c1fa32667692a2c0566e10163758e786e430c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1e247338bc71826a2d2def3e0874c34749df69a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63824.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-63824"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502248"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63824"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63824"},{"url":"https://lore.kernel.org/linux-cve-announce/2026071906-CVE-2026-63824-6a2f@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:63128"},{"url":"https://access.redhat.com/errata/RHSA-2026:63129"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00169,"epssPercentile":0.06219,"ingestedAt":"2026-08-17T05:47:49.880Z","vendor":"Linux","product":"Linux","affected":["Linux >= 00d60fd3b93219ea854220f0fd264b86398cbc53 < 622ec2dcd59f21623f2a7ab773c80ceb7d555e3a","Linux >= 00d60fd3b93219ea854220f0fd264b86398cbc53 < b1e247338bc71826a2d2def3e0874c34749df69a","Linux >= 00d60fd3b93219ea854220f0fd264b86398cbc53 < 0f3058d7d26f81df9b68a18ddbe164bdc3c5eff3","Linux >= 00d60fd3b93219ea854220f0fd264b86398cbc53 < 5966e4e2ba213ab7ad559166152eb4f1f170dd2c","Linux >= 00d60fd3b93219ea854220f0fd264b86398cbc53 < 5165f1cc727f1322456735df212d8e26ec237a8d","Linux >= 00d60fd3b93219ea854220f0fd264b86398cbc53 < b11c1fa32667692a2c0566e10163758e786e430c","Linux >= 00d60fd3b93219ea854220f0fd264b86398cbc53 < 670fc6a311ed321522b7fff92cf0fc376b4f6e78","Linux >= 00d60fd3b93219ea854220f0fd264b86398cbc53 < cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b","Linux 4.20"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:31:12.388673Z"},"patched":["enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_10","enterprise_linux_real_time_v_9"],"cwe":["CWE-787"],"scores":{"nvd":7.8,"vendor":7,"cna":7.8},"slug":"CVE-2026-63824","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: fix overflow in keyctl_pkey_params_get_2()\n\nThe length for the internal output buffer is calculated incorrectly, which\ncan result overflow when a too small buffer is provided.\n\nFix the bug by allocating internal output with the size of the maximum\nlength of the cryptographic primitive instead of caller provided size.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:63128** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:63128)\n- **RHSA-2026:63129** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:63129)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63824.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}