---
id: CVE-2026-63824
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KEYS: fix overflow in keyctl_pkey_params_get_2()

  The length for the internal output buffer is calculated incorrectly, which
  can result overflow when a too small buffer…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KEYS: fix overflow in keyctl_pkey_params_get_2()

  The length for the internal output buffer is calculated incorrectly, which
  can result overflow when a too small buffer…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
published: '2026-07-19'
updated: '2026-08-17'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63824'
references:
  - url: 'https://git.kernel.org/stable/c/0f3058d7d26f81df9b68a18ddbe164bdc3c5eff3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5165f1cc727f1322456735df212d8e26ec237a8d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5966e4e2ba213ab7ad559166152eb4f1f170dd2c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/622ec2dcd59f21623f2a7ab773c80ceb7d555e3a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/670fc6a311ed321522b7fff92cf0fc376b4f6e78'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b11c1fa32667692a2c0566e10163758e786e430c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b1e247338bc71826a2d2def3e0874c34749df69a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63824.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-63824'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2502248'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-63824'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63824'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026071906-CVE-2026-63824-6a2f@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2026:63128'
  - url: 'https://access.redhat.com/errata/RHSA-2026:63129'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00169
epssPercentile: 0.06219
ingestedAt: '2026-08-17T05:47:49.880Z'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 00d60fd3b93219ea854220f0fd264b86398cbc53 <
    622ec2dcd59f21623f2a7ab773c80ceb7d555e3a
  - >-
    Linux >= 00d60fd3b93219ea854220f0fd264b86398cbc53 <
    b1e247338bc71826a2d2def3e0874c34749df69a
  - >-
    Linux >= 00d60fd3b93219ea854220f0fd264b86398cbc53 <
    0f3058d7d26f81df9b68a18ddbe164bdc3c5eff3
  - >-
    Linux >= 00d60fd3b93219ea854220f0fd264b86398cbc53 <
    5966e4e2ba213ab7ad559166152eb4f1f170dd2c
  - >-
    Linux >= 00d60fd3b93219ea854220f0fd264b86398cbc53 <
    5165f1cc727f1322456735df212d8e26ec237a8d
  - >-
    Linux >= 00d60fd3b93219ea854220f0fd264b86398cbc53 <
    b11c1fa32667692a2c0566e10163758e786e430c
  - >-
    Linux >= 00d60fd3b93219ea854220f0fd264b86398cbc53 <
    670fc6a311ed321522b7fff92cf0fc376b4f6e78
  - >-
    Linux >= 00d60fd3b93219ea854220f0fd264b86398cbc53 <
    cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b
  - Linux 4.20
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:31:12.388673Z'
patched:
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_v_9
  - enterprise_linux_baseos_v_10
  - enterprise_linux_baseos_v_9
  - enterprise_linux_codeready_linux_builder_v_10
  - enterprise_linux_codeready_linux_builder_v_9
  - enterprise_linux_real_time_for_nfv_v_10
  - enterprise_linux_real_time_for_nfv_v_9
  - enterprise_linux_real_time_v_10
  - enterprise_linux_real_time_v_9
cwe:
  - CWE-787
scores:
  nvd: 7.8
  vendor: 7
  cna: 7.8
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KEYS: fix overflow in keyctl_pkey_params_get_2()

The length for the internal output buffer is calculated incorrectly, which
can result overflow when a too small buffer is provided.

Fix the bug by allocating internal output with the size of the maximum
length of the cryptographic primitive instead of caller provided size.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:63128** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:63128)
- **RHSA-2026:63129** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:63129)
- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63824.json)