In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyring_get_key_chunk() For descrip…
CVE-2026-74567 · published 15 Aug 2026
How serious is it
- Severity: high, CVSS score 7.1 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-74567?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 5.3
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
keys: fix out-of-bounds read in keyring_get_key_chunk()
For description-level chunks keyring_get_key_chunk() advances the read
pointer by level * sizeof(long) past the inline prefix but only
bounds-checks the prefix, so a long enough key description is read past
its kmemdup(desc, desc_len + 1) allocation. Compute the full byte
offset and bounds-check the description against it before reading.
The walk only reaches a description-level chunk when two keys collide
through the hash, x, type and domain_tag chunks, so this is reached from
an unprivileged add_key(2) with a crafted pair of same-type keys whose
index hashes collide; KASAN reports a slab-out-of-bounds read.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/3a744838453fb9309ce5a5526d3252e211d60152
- git.kernel.org/stable/c/4c0c26f751e50d3027eacc4d7d0fabc31f1d7e6b
- git.kernel.org/stable/c/63918731f9ae25b5deb022f118e941e6dddfcef4
- git.kernel.org/stable/c/79916f40d4ab1b4ae694d8c024fd179454bfe46e
- git.kernel.org/stable/c/8dba33c1e779d0fb9a2acb31e354cf0fc0229111
- git.kernel.org/stable/c/d1933e03e8c74a018550c31a393b79c4d95bff40
- git.kernel.org/stable/c/e5b01998cef8d7f613200230ccaadebe5de9135c
- git.kernel.org/stable/c/e9417d21a22ad2ec398e78fcf084b717ce92cf2f
Merged from NVD. Last updated 24 Oct 2026. All vulnerabilities · RSS · JSON