Executive brief
eCryptfs is a cryptographic filesystem used to encrypt data at rest on Linux systems. A race condition in the daemon queue cleanup code can allow multiple threads to corrupt shared data structures simultaneously, potentially leading to system crashes or privilege escalation when users interact with encrypted filesystems.
Technical details
The vulnerability is a race condition (missing synchronization) in the eCryptfs messaging subsystem. When ecryptfs_exorcise_daemon() cleans up queued messages from a dying daemon, it fails to hold the ecryptfs_msg_ctx_lists_mux lock required by ecryptfs_msg_ctx_alloc_to_free(). This allows concurrent threads to manipulate the global message context list simultaneously, causing data structure corruption. The fix acquires the mutex before manipulating the daemon's message queue. Attack vector is local with no authentication required; any process using eCryptfs can trigger the race condition. A patch has been released.
Affected products
- Linux Linux kernel multiple versions (patch applied across 2.6.11 through 7.2 stable branches)
Timeline
- 2026-09-11: disclosed: Published on NVD
- 2026-09-07: patched: Fix merged into Linux stable trees via commit 779972513c2fa8c7938e54976f686091dafff22f