CVE-2026-68148

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fscrypt: Add missing superblock check in find_or_insert_direct_key()

The legacy 'fscrypt_direct_keys' table caches master keys that are used

by v1 encryption policies that have FSCRYPT_POLICY_FLAG_DIRECT_KEY.

It's just a global table for all filesystems (since the keys can be

provided by the legacy process-subscribed keyrings mechanism, which

makes it difficult to reuse super_block::s_master_keys).

The entries in it ('struct fscrypt_direct_key') do contain a super_block

pointer, though, for passing to fscrypt_destroy_inline_crypt_key() when

the last inode that references the key is evicted.

However, when finding the fscrypt_direct_key for an inode, we weren't

actually comparing the super_block pointer. As a result, inodes with

different super_blocks could point to the same fscrypt_direct_key. That

could extend the lifetime of a fscrypt_direct_key beyond the

super_block it points to, causing a use-after-free later

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References