{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63824", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.014Z", "datePublished": "2026-07-19T12:02:20.406Z", "dateUpdated": "2026-08-05T12:36:07.930Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:36:07.930Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: fix overflow in keyctl_pkey_params_get_2()\n\nThe length for the internal output buffer is calculated incorrectly, which\ncan result overflow when a too small buffer is provided.\n\nFix the bug by allocating internal output with the size of the maximum\nlength of the cryptographic primitive instead of caller provided size."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reachable only through the keyctl(2) syscall (KEYCTL_PKEY_ENCRYPT, KEYCTL_PKEY_DECRYPT, or KEYCTL_PKEY_SIGN); there is no network, adjacent, or physical attack path to the affected code.\nAC:L - An attacker fully controls the undersized out_len parameter and can reliably trigger the bug on demand with no races or victim-dependent state; CONFIG_ASYMMETRIC_KEY_TYPE is commonly enabled on server and desktop kernels.\nPR:L - Exploitation requires KEY_NEED_SEARCH on an asymmetric key, which any unprivileged local user can satisfy by loading their own RSA/EC key into a session keyring; no real root or init-namespace capabilities are needed.\nUI:N - Exploitation requires only attacker-initiated keyctl calls and does not depend on any victim user action such as opening a file or mounting a filesystem.\nS:U - Impact is confined to kernel heap memory corruption and privilege escalation within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - When out_len is smaller than the cryptographic output (including out_len=0 where kmalloc(0) yields ZERO_SIZE_PTR), asym_eds_op returns the full primitive output size and copy_to_user reads far beyond the allocated buffer, leaking adjacent kernel heap contents to userspace.\nI:H - The undersized kmalloc buffer is passed directly as the crypto output target; asymmetric operations can write up to the primitive maximum (hundreds of bytes for RSA-4096) past the allocation, enabling heap corruption and potential control-flow hijacking.\nA:H - Heap out-of-bounds read/write against kmalloc objects or writes through ZERO_SIZE_PTR can cause kernel oops, panic, or KASAN-detected corruption, satisfying high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/keys/keyctl_pkey.c"], "versions": [{"version": "00d60fd3b93219ea854220f0fd264b86398cbc53", "lessThan": "622ec2dcd59f21623f2a7ab773c80ceb7d555e3a", "status": "affected", "versionType": "git"}, {"version": "00d60fd3b93219ea854220f0fd264b86398cbc53", "lessThan": "b1e247338bc71826a2d2def3e0874c34749df69a", "status": "affected", "versionType": "git"}, {"version": "00d60fd3b93219ea854220f0fd264b86398cbc53", "lessThan": "0f3058d7d26f81df9b68a18ddbe164bdc3c5eff3", "status": "affected", "versionType": "git"}, {"version": "00d60fd3b93219ea854220f0fd264b86398cbc53", "lessThan": "5966e4e2ba213ab7ad559166152eb4f1f170dd2c", "status": "affected", "versionType": "git"}, {"version": "00d60fd3b93219ea854220f0fd264b86398cbc53", "lessThan": "5165f1cc727f1322456735df212d8e26ec237a8d", "status": "affected", "versionType": "git"}, {"version": "00d60fd3b93219ea854220f0fd264b86398cbc53", "lessThan": "b11c1fa32667692a2c0566e10163758e786e430c", "status": "affected", "versionType": "git"}, {"version": "00d60fd3b93219ea854220f0fd264b86398cbc53", "lessThan": "670fc6a311ed321522b7fff92cf0fc376b4f6e78", "status": "affected", "versionType": "git"}, {"version": "00d60fd3b93219ea854220f0fd264b86398cbc53", "lessThan": "cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/keys/keyctl_pkey.c"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.260", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.211", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.177", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.144", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.95", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.38", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.3", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.10.260"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.15.211"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.177"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.144"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.18.38"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.1.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.2-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/622ec2dcd59f21623f2a7ab773c80ceb7d555e3a"}, {"url": "https://git.kernel.org/stable/c/b1e247338bc71826a2d2def3e0874c34749df69a"}, {"url": "https://git.kernel.org/stable/c/0f3058d7d26f81df9b68a18ddbe164bdc3c5eff3"}, {"url": "https://git.kernel.org/stable/c/5966e4e2ba213ab7ad559166152eb4f1f170dd2c"}, {"url": "https://git.kernel.org/stable/c/5165f1cc727f1322456735df212d8e26ec237a8d"}, {"url": "https://git.kernel.org/stable/c/b11c1fa32667692a2c0566e10163758e786e430c"}, {"url": "https://git.kernel.org/stable/c/670fc6a311ed321522b7fff92cf0fc376b4f6e78"}, {"url": "https://git.kernel.org/stable/c/cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b"}], "title": "KEYS: fix overflow in keyctl_pkey_params_get_2()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["security/keys/keyctl_pkey.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "622ec2dcd59f21623f2a7ab773c80ceb7d555e3a", "status": "affected", "version": "00d60fd3b93219ea854220f0fd264b86398cbc53", "versionType": "git"}, {"lessThan": "b1e247338bc71826a2d2def3e0874c34749df69a", "status": "affected", "version": "00d60fd3b93219ea854220f0fd264b86398cbc53", "versionType": "git"}, {"lessThan": "0f3058d7d26f81df9b68a18ddbe164bdc3c5eff3", "status": "affected", "version": "00d60fd3b93219ea854220f0fd264b86398cbc53", "versionType": "git"}, {"lessThan": "5966e4e2ba213ab7ad559166152eb4f1f170dd2c", "status": "affected", "version": "00d60fd3b93219ea854220f0fd264b86398cbc53", "versionType": "git"}, {"lessThan": "5165f1cc727f1322456735df212d8e26ec237a8d", "status": "affected", "version": "00d60fd3b93219ea854220f0fd264b86398cbc53", "versionType": "git"}, {"lessThan": "b11c1fa32667692a2c0566e10163758e786e430c", "status": "affected", "version": "00d60fd3b93219ea854220f0fd264b86398cbc53", "versionType": "git"}, {"lessThan": "670fc6a311ed321522b7fff92cf0fc376b4f6e78", "status": "affected", "version": "00d60fd3b93219ea854220f0fd264b86398cbc53", "versionType": "git"}, {"lessThan": "cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b", "status": "affected", "version": "00d60fd3b93219ea854220f0fd264b86398cbc53", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["security/keys/keyctl_pkey.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.260", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.211", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.177", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.144", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.95", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.38", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: fix overflow in keyctl_pkey_params_get_2()\n\nThe length for the internal output buffer is calculated incorrectly, which\ncan result overflow when a too small buffer is provided.\n\nFix the bug by allocating internal output with the size of the maximum\nlength of the cryptographic primitive instead of caller provided size."}], "id": "CVE-2026-63824", "lastModified": "2026-07-27T17:44:23.777", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T12:16:55.583", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f3058d7d26f81df9b68a18ddbe164bdc3c5eff3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5165f1cc727f1322456735df212d8e26ec237a8d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5966e4e2ba213ab7ad559166152eb4f1f170dd2c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/622ec2dcd59f21623f2a7ab773c80ceb7d555e3a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/670fc6a311ed321522b7fff92cf0fc376b4f6e78"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b11c1fa32667692a2c0566e10163758e786e430c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b1e247338bc71826a2d2def3e0874c34749df69a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: KEYS: fix overflow in keyctl_pkey_params_get_2()", "id": "2502248", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502248"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nKEYS: fix overflow in keyctl_pkey_params_get_2()\nThe length for the internal output buffer is calculated incorrectly, which\ncan result overflow when a too small buffer is provided.\nFix the bug by allocating internal output with the size of the maximum\nlength of the cryptographic primitive instead of caller provided size.", "A flaw was found in the Linux kernel's `keyctl_pkey_params_get_2()` function within the KEYS subsystem. The vulnerability arises from an incorrect calculation of the internal output buffer's length, which can lead to a buffer overflow when a user-provided buffer is too small. This flaw could allow a local attacker to corrupt memory, potentially leading to a denial of service or other unspecified impacts."], "name": "CVE-2026-63824", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63824\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63824\nhttps://lore.kernel.org/linux-cve-announce/2026071906-CVE-2026-63824-6a2f@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00d60fd3b93219ea854220f0fd264b86398cbc53,622ec2dcd59f21623f2a7ab773c80ceb7d555e3a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00d60fd3b93219ea854220f0fd264b86398cbc53,b1e247338bc71826a2d2def3e0874c34749df69a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00d60fd3b93219ea854220f0fd264b86398cbc53,0f3058d7d26f81df9b68a18ddbe164bdc3c5eff3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00d60fd3b93219ea854220f0fd264b86398cbc53,5966e4e2ba213ab7ad559166152eb4f1f170dd2c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00d60fd3b93219ea854220f0fd264b86398cbc53,5165f1cc727f1322456735df212d8e26ec237a8d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00d60fd3b93219ea854220f0fd264b86398cbc53,b11c1fa32667692a2c0566e10163758e786e430c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00d60fd3b93219ea854220f0fd264b86398cbc53,670fc6a311ed321522b7fff92cf0fc376b4f6e78)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00d60fd3b93219ea854220f0fd264b86398cbc53,cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.20"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.20)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.260,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.211,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.177,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.144,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.95,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.38,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.3,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T03:15:02.663496+00:00", "updated": "2026-07-30T22:15:13.611055+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}