The Linux kernel's eCryptfs module had a vulnerability where parse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body without bounding it against ECRYPTFS_MAX_KEY_BYTES (64). When encrypted_key_size exceeded 64, decrypt_passphrase_encrypted_session_key() performed two out-of-bounds writes: one during crypto_skcipher_decrypt() and another via memcpy() into crypt_stat->key, corrupting adjacent memory structures. This was possible only for AES-192 cipher code 0x08, which allowed crypto_skcipher_setkey() to succeed with an oversized encrypted_key_size. The fix enforces bounding encrypted_key_size to 64 bytes, removing a redundant 512-byte check and preventing memory corruption.

The vulnerability could lead to memory corruption in kernel space due to out-of-bounds writes, potentially destabilizing the system or enabling privilege escalation. However, exploitation requires use of the AES-192 cipher path in eCryptfs with crafted oversized encrypted_key_size values. There are no known exploits in the wild.

A fix has been implemented in the Linux kernel to bound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64). Users should update to a kernel version that includes this patch. No additional mitigations are specified or required beyond applying the official fix.