CVE-2026-68147
Received Received - Intake

Memory Corruption in Linux Kernel fscrypt

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fscrypt: Avoid dynamic allocation in fscrypt_get_devices() When a blk_crypto_key starts being used or is evicted, fs/crypto/ calls fscrypt_get_devices() to get the filesystem's list of block devices, then iterates over them and calls blk_crypto_config_supported(), blk_crypto_start_using_key(), or blk_crypto_evict_key() on each one. Currently, the block device pointers are placed in a dynamically allocated array. This dynamic allocation is problematic because: - It can fail, especially at the fscrypt_destroy_inline_crypt_key() call site when it's invoked for inode eviction under direct reclaim. - fscrypt_destroy_inline_crypt_key() doesn't handle the failure. It just zeroizes and frees the blk_crypto_key without calling blk_crypto_evict_key(). That causes a use-after-free. For now, let's fix this in the straightforward and easily-backportable way by switching to an on-stack array. Currently the fscrypt multi-device functionality is used only by f2fs, which has a hardcoded limit of 8 block devices. An on-stack array works fine for that. (Of course, this solution won't scale up to large number of block devices. For that we'd need a different solution, like moving the block device iteration into the filesystem. Or in the case of btrfs, which will only support blk-crypto-fallback, we should make it just call blk-crypto-fallback directly, so the block devices won't be needed.)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68147
EUVD
EUVD-2026-55532

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the fscrypt component where dynamic memory allocation during block device operations can lead to failures and use-after-free errors. Specifically, when handling encryption keys, the system attempts to allocate memory for an array of block device pointers, which may fail under memory pressure. If it fails, the system does not properly handle the error, leading to a use-after-free condition when the key is destroyed.

Detection Guidance

This vulnerability is specific to the Linux kernel's fscrypt subsystem and does not have a direct network detection method. To check if your system is affected, verify if your kernel version includes the vulnerable code path by examining the kernel source or running uname -a to check the kernel version. If your kernel is vulnerable, look for errors in kernel logs related to fscrypt or block device operations.

Impact Analysis

This vulnerability can cause system crashes or instability, particularly when the kernel is under memory pressure. It may lead to data corruption or security issues due to the use-after-free condition, which could allow unauthorized access or privilege escalation. Systems using fscrypt for filesystem encryption, especially those with multiple block devices, are most affected.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve this issue. If patches are not yet available, consider disabling fscrypt or using filesystems that do not rely on multi-device functionality until the fix is applied. Monitor kernel logs for errors related to fscrypt or block device operations as a potential indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68147. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart