CVE-2026-89605

A flaw in the Linux kernel's eCryptfs stacked cryptographic filesystem leaks internal message contexts when a send to the userspace helper daemon fails: ecryptfs_send_message_locked() moves a context onto the allocated list before sending, and if ecryptfs_send_miscdev() fails the context is stranded there instead of being returned to the free pool, making it permanently unusable. The bug is triggered locally whenever eCryptfs needs to communicate with its userspace daemon (ecryptfsd via the miscdev interface) and that send fails, for example when the daemon is unresponsive or the message cannot be delivered. A local low-privileged attacker who can repeatedly induce these failed sends can exhaust the pool of message contexts, degrading or denying eCryptfs operations (a denial-of-service condition); CVSS 3.1 assigns 7.8 with high confidentiality, integrity and availability impact locally, though the practical effect is primarily resource exhaustion. Only systems that actually configure and use eCryptfs (typically legacy encrypted-home-directory setups) are exposed to the vulnerable code path. There is no known public proof of concept and no evidence of in-the-wild exploitation.

What to do: Apply distribution kernel updates once the upstream fix is backported, and reboot into the patched kernel. If eCryptfs is not needed, blacklist the ecryptfs kernel module and migrate encrypted-home users to LUKS-based full-disk encryption. On hosts that must keep eCryptfs, monitor for repeated message-send failures to ecryptfsd and resource exhaustion of the message context pool.