---
id: CVE-2026-89608
title: 'ecryptfs: pass packet set buffer size to parser'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ecryptfs: pass packet set buffer size to parser

  ecryptfs_parse_packet_set() receives a pointer into the file header, but
  it calculates the remaining packet buffer size…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-131
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 237fead619984cc48818fe12ee0ceada3f55b012 <
    e7573b0e3058c6bbdfe81673f22c09900fde9e65
  - >-
    Linux >= 237fead619984cc48818fe12ee0ceada3f55b012 <
    66a87559ecb26afe80ad512faf728a158e2b81da
  - >-
    Linux >= 237fead619984cc48818fe12ee0ceada3f55b012 <
    3bd9bb3e167a7c14a50423f6ff03ee0fb007199d
  - >-
    Linux >= 237fead619984cc48818fe12ee0ceada3f55b012 <
    749fa08d8f1b318bd8f4669a14a8a4a8c1bbdaac
  - >-
    Linux >= 237fead619984cc48818fe12ee0ceada3f55b012 <
    329de8b9e988b152b938f09224670d97bada0b96
  - >-
    Linux >= 237fead619984cc48818fe12ee0ceada3f55b012 <
    e5d254e654f2311a3c4b9c791d7f216554bcd17a
  - >-
    Linux >= 237fead619984cc48818fe12ee0ceada3f55b012 <
    747fd45be396a6aea3420ab657a0ab4e60185b05
  - >-
    Linux >= 237fead619984cc48818fe12ee0ceada3f55b012 <
    2602b79c5b3e2f6fce12e38a670f8e3fda4e46a2
  - Linux 2.6.19
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:49:40.341Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89608'
references:
  - url: 'https://git.kernel.org/stable/c/e7573b0e3058c6bbdfe81673f22c09900fde9e65'
  - url: 'https://git.kernel.org/stable/c/66a87559ecb26afe80ad512faf728a158e2b81da'
  - url: 'https://git.kernel.org/stable/c/3bd9bb3e167a7c14a50423f6ff03ee0fb007199d'
  - url: 'https://git.kernel.org/stable/c/749fa08d8f1b318bd8f4669a14a8a4a8c1bbdaac'
  - url: 'https://git.kernel.org/stable/c/329de8b9e988b152b938f09224670d97bada0b96'
  - url: 'https://git.kernel.org/stable/c/e5d254e654f2311a3c4b9c791d7f216554bcd17a'
  - url: 'https://git.kernel.org/stable/c/747fd45be396a6aea3420ab657a0ab4e60185b05'
  - url: 'https://git.kernel.org/stable/c/2602b79c5b3e2f6fce12e38a670f8e3fda4e46a2'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89608.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89608'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532240'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89608'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89608'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89608.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00164
epssPercentile: 0.0557
scores:
  cna: 7.1
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.450Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ecryptfs: pass packet set buffer size to parser

ecryptfs_parse_packet_set() receives a pointer into the file header, but
it calculates the remaining packet buffer size from PAGE_SIZE - 8.  For
version 1 headers the packet set starts later in the header, so this can
overstate the available buffer.

Pass the actual packet set buffer length from the caller and calculate
per-packet limits from the remaining bytes in that buffer.  Recompute the
remaining length after consuming a tag 3 packet before parsing the
following tag 11 packet.

## Affected

- `Linux >= 237fead619984cc48818fe12ee0ceada3f55b012 < e7573b0e3058c6bbdfe81673f22c09900fde9e65`
- `Linux >= 237fead619984cc48818fe12ee0ceada3f55b012 < 66a87559ecb26afe80ad512faf728a158e2b81da`
- `Linux >= 237fead619984cc48818fe12ee0ceada3f55b012 < 3bd9bb3e167a7c14a50423f6ff03ee0fb007199d`
- `Linux >= 237fead619984cc48818fe12ee0ceada3f55b012 < 749fa08d8f1b318bd8f4669a14a8a4a8c1bbdaac`
- `Linux >= 237fead619984cc48818fe12ee0ceada3f55b012 < 329de8b9e988b152b938f09224670d97bada0b96`
- `Linux >= 237fead619984cc48818fe12ee0ceada3f55b012 < e5d254e654f2311a3c4b9c791d7f216554bcd17a`
- `Linux >= 237fead619984cc48818fe12ee0ceada3f55b012 < 747fd45be396a6aea3420ab657a0ab4e60185b05`
- `Linux >= 237fead619984cc48818fe12ee0ceada3f55b012 < 2602b79c5b3e2f6fce12e38a670f8e3fda4e46a2`
- `Linux 2.6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 6 · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89608.json)