The Linux kernel's eCryptfs implementation had a vulnerability in the ecryptfs_parse_tag_70_packet() function where it subtracted fixed metadata field sizes from the parsed packet body size to determine the encrypted filename size. If a malformed packet with a body smaller than these fixed fields was processed, the size calculation could underflow. This could lead to incorrect handling of the packet. The vulnerability was addressed by rejecting tag 70 packets that lack the necessary signature, cipher code, and minimum encrypted filename data before performing the subtraction.

The vulnerability could cause incorrect processing of malformed eCryptfs tag 70 packets due to size underflow in encrypted filename size calculation. The exact impact is not detailed in the input data, and no known exploits in the wild are reported. The issue could potentially lead to denial of service or other unintended behavior when handling malformed packets.

A fix has been implemented in the Linux kernel to reject malformed tag 70 packets before size calculations are performed. Users should apply the official kernel update that includes this fix. Since no patch links or vendor advisory are provided, check the Linux kernel official sources for the relevant update. No additional mitigation steps are indicated.