The Linux kernel KEYS module contains an integer overflow when computing the size of a data blob for an encrypted key. The datablob_len value is truncated to a 16‑bit unsigned integer, leading to an undersized buffer allocation. Subsequent copying of the master key description into the truncated buffer causes a kernel heap overflow, potentially corrupting arbitrary memory and enabling privilege escalation or denial of service. The flaw arises from improper handling of combined string and payload lengths during key initialization.

The flaw exists in the Linux kernel, specifically in the encrypted key subsystem of the KEYS module. All Linux kernel versions that have not yet applied the integer overflow fix are affected. The vulnerability applies to any kernel that uses the KEYS module and the /dev/keys interface.

The EPSS score is below 1% and the vulnerability is not yet listed in CISA’s KEV catalog, indicating low but non‑zero exploitation probability. The flaw is a local kernel vulnerability; an attacker needs write access to /dev/keys or the ability to create a KEYS entry. Once triggered, the buffer overflow can overwrite arbitrary heap memory, potentially allowing execution of arbitrary code with kernel privileges. Given the absence of public exploit code and the limited attack surface, the risk is high for systems that allow local or privileged access to the kernel.