Cloudanix VulnDB

CVE-2026-89609

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A locking mistake in Linux encrypted filesystem handling could let a local user crash the system or gain extra access.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in ecryptfs where ecryptfs_exorcise_daemon drops queued messages without holding ecryptfs_msg_ctx_lists_mux while ecryptfs_msg_ctx_alloc_to_free requires the lock, allowing concurrent list manipulation.

Why it matters to the business

Local attackers on affected systems can trigger crashes or memory corruption in encrypted filesystem operations, leading to denial of service or potential privilege escalation on Linux hosts using ecryptfs.

How an attack unfolds

An attacker starts an ecryptfs daemon, queues messages, then kills the daemon to invoke exorcise while another thread performs allocation or free operations, racing the unprotected list access to corrupt kernel structures.

How to fix it

Apply the upstream kernel patch that acquires ecryptfs_msg_ctx_lists_mux in ecryptfs_exorcise_daemon before moving contexts to the free list; rebuild and deploy the fixed kernel.

How to confirm the fix worked

Confirm the fix by inspecting the ecryptfs_exorcise_daemon function for the added lock acquisition around the list move, or verify the kernel source contains the resolved commit.

Typical attack path

  1. Mount ecryptfs filesystem and trigger daemon activity
  2. Kill the ecryptfs daemon process to invoke exorcise_daemon
  3. Concurrently perform operations that call msg_ctx_alloc_to_free
  4. Trigger list corruption leading to use-after-free or invalid memory access

How to detect it

Review kernel logs for ecryptfs-related list corruption warnings, oops traces mentioning msg_ctx_lists_mux, or unexpected daemon terminations followed by filesystem errors.

What your security team should do

  • Prioritize kernel updates for systems using ecryptfs
  • Audit workloads for ecryptfs usage and schedule reboots after patching
  • Monitor for related kernel oops or list corruption reports in dmesg

The record

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfs_exorcise_daemon() drops queued messages from a dying daemon without holding ecryptfs_msg_ctx_lists_mux, but ecryptfs_msg_ctx_alloc_to_free() requires that lock. Take the list lock while moving the queued contexts back to the free list to avoid racing with other global msg ctx list users.

Affected packages

Ecosystem Package Introduced Fixed