A heap-based buffer overflow vulnerability in the Linux kernel ecryptfs subsystem allows a local authenticated attacker to achieve arbitrary code execution or cause a system crash.

The parse_tag_3_packet function in the ecryptfs module fails to bound the encrypted_key_size parameter against the ECRYPTFS_MAX_KEY_BYTES constant. This oversight allows an authenticated local user to trigger out-of-bounds writes to the kernel heap, potentially corrupting sensitive structures including mutexes and key management data.

The vulnerability carries a CVSS score of 7.8, indicating a high severity risk. Successful exploitation allows a local attacker to escalate privileges or compromise the integrity and availability of the host operating system. Given the kernel-level nature of the flaw, this could result in full system compromise, data exfiltration, or persistent denial of service, which is critical for systems handling sensitive encrypted data.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later immediately to incorporate the necessary bounds checking.

Proactive Monitoring: Monitor system logs for kernel-related faults or unexpected crashes in the ecryptfs filesystem module.

Compensating Controls: Restrict access to the system to authorized users only, as the attack requires local access. Ensure that kernel hardening features such as KASLR and heap protection mechanisms are enabled to increase the complexity of successful exploitation.

Public Exploit Available: No

This vulnerability represents a significant risk to systems utilizing the ecryptfs encrypted filesystem. Administrators should prioritize patching the kernel across all relevant environments as part of the next scheduled maintenance cycle or sooner if the environment supports high-risk data. Failure to apply these updates leaves the system susceptible to local privilege escalation and potential kernel-level instability.