CVE-2026-74567

A moderate out-of-bounds read flaw was found in the Linux kernel's key management subsystem. When walking description-level key chunks, keyring_get_key_chunk() advances the read pointer past the inline prefix without bounds-checking the full byte offset against the key description length, so a sufficiently long key description can be read past its allocation. A local unprivileged attacker could trigger this flaw through the add_key(2) system call by creating a crafted pair of same-type keys whose index hashes collide, causing a slab out-of-bounds read that could crash the system (denial of service) or disclose a limited amount of kernel memory. The kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10 and in Red Hat In-Vehicle OS 2 are affected, and the fix for these streams has been deferred to a future update, so the residual risk is that a local unprivileged user can trigger the out-of-bounds read until a fixed kernel is delivered. The Red Hat Enterprise Linux 6 Extended Lifecycle Support stream is out of support scope, and Red Hat Enterprise Linux 7 and 8 are not affected because the vulnerable code is not present in their kernels. Red Hat rates this flaw as Moderate impact (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the upstream CVE.org rating of Important (score 7.1), because Red Hat's assessment finds the impact on Red Hat products to be limited to availability with no confidentiality impact.