CVE-2026-68147

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fscrypt: Avoid dynamic allocation in fscrypt_get_devices()

When a blk_crypto_key starts being used or is evicted, fs/crypto/ calls

fscrypt_get_devices() to get the filesystem's list of block devices,

then iterates over them and calls blk_crypto_config_supported(),

blk_crypto_start_using_key(), or blk_crypto_evict_key() on each one.

Currently, the block device pointers are placed in a dynamically

allocated array. This dynamic allocation is problematic because:

- It can fail, especially at the fscrypt_destroy_inline_crypt_key() call

site when it's invoked for inode eviction under direct reclaim.

- fscrypt_destroy_inline_crypt_key() doesn't handle the failure. It

just zeroizes and frees the blk_crypto_key without calling

blk_crypto_evict_key(). That causes a use-after-free.

For now, let's fix this in the straightforward and easily-backportable

way by switching to an on-stack array. Currently the fscrypt

mu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References