Use-after-free in Linux kernel - CVE-2026-68147

Vulnerability details

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a use-after-free in fscrypt_destroy_inline_crypt_key() and fscrypt_get_devices() in fs/crypto/inline_crypt.c when evicting inline encryption keys for filesystem block devices. A local user can trigger key eviction during inode eviction under direct reclaim to cause a use-after-free.

The issue occurs when dynamic allocation of the block-device array fails, causing key memory to be freed without first evicting the key from all associated block devices.

Affected software

How to mitigate CVE-2026-68147

External References

• https://git.kernel.org/stable/c/4462ac3d90e897dda52ce4b6af2d526ddae835a8
• https://git.kernel.org/stable/c/6fe4e4b8259e1330945b5f3c9476e08473b8e0e8
• https://git.kernel.org/stable/c/81ea8e8221853950c47dac7164f27c63a96f8f86
• https://git.kernel.org/stable/c/97a688563be71ec6fefc071aff69a66c69dbe244
• https://git.kernel.org/stable/c/bc2d630296e0e049210ec05ff08459a6893ae749

Related Security Bulletins

• Use-after-free in Linux kernel fscrypt_destroy_inline_crypt_key() and fscrypt_get_devices() in fs/crypto/inline_crypt.c
• Ubuntu update for linux-nvidia-tegra