Executive brief
eCryptfs is a Linux kernel encryption layer that handles encrypted filesystems. A bug in message handling causes message context resources to leak when a daemon communication fails, preventing reuse and potentially exhausting available contexts. An attacker or malfunctioning daemon could trigger repeated failures to cause a denial of service.
Technical details
The vulnerability is a resource leak in the eCryptfs messaging subsystem. In ecryptfs_send_message_locked(), when a message context is moved from the free list to the allocated list but ecryptfs_send_miscdev() fails to send it to the userspace daemon, the context is not moved back to the free list and cannot be reused. This exhaustion of message contexts can prevent legitimate eCryptfs operations from functioning. The fix moves the context back to the free list on send failure and clears the caller's pointer. The vulnerability affects the kernel's fs/ecryptfs/messaging.c component and can be triggered by any local user with access to eCryptfs operations or by a malicious or crashed userspace daemon.
Affected products
- Linux Linux kernel multiple versions (patched in stable branches)
Timeline
- 2026-07-01: disclosed
- 2026-07-17: patched: upstream patch commit 219644a3ad5518217b2d62cad6d2c36a2308c949
- 2026-09-14: patched: stable tree patch commit 177e0c32fec3602bb3b64139bb8bb610cd6722c7
- 2026-09-11: advisory