CVE-2026-89609

The Linux kernel's eCryptfs subsystem contains a race condition in which ecryptfs_exorcise_daemon(), the routine that cleans up after a dying eCryptfs userspace daemon, moves queued message contexts back to the free list without holding the required ecryptfs_msg_ctx_lists_mux lock. Because ecryptfs_msg_ctx_alloc_to_free() expects that lock to be held, concurrent access to the global message-context list by other kernel threads can race with the cleanup, potentially corrupting the list or the freed contexts (use-after-free style memory corruption). Triggering the flaw requires local access with low privileges on a system actively using the eCryptfs daemon messaging interface, and successful exploitation could yield high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8). Primarily affected are Linux systems running kernels with the vulnerable eCryptfs code while the eCryptfs daemon (ecryptfsd) messaging path is in use — a configuration that is increasingly rare since major distributions deprecated eCryptfs home-directory encryption. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and there is no indication of exploitation in the wild.

What to do: Apply Linux kernel updates from your distribution once they include the eCryptfs fixing commit that takes the message-context list lock during daemon exorcism. On systems that do not use eCryptfs, ensure the ecryptfs kernel module is not loaded and the ecryptfsd daemon is not running to eliminate the vulnerable code path. Legacy encrypted-home deployments should plan migration to a supported mechanism such as fscrypt or full-disk encryption (LUKS).