CVE-2026-89605

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: release message context on send failure ecryptfs_send_message_locked() moves a message context from the free list to the allocated list before sending the request to the userspace daemon. If ecryptfs_send_miscdev() fails, the context is left on the allocated list and cannot be reused. Move it back to the free list on failure and clear the caller's pointer.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/177e0c32fec3602bb3b64139bb8bb610cd6722c7
https://git.kernel.org/stable/c/219644a3ad5518217b2d62cad6d2c36a2308c949
https://git.kernel.org/stable/c/30845ed227475a11a49ccce047837d016b7e0f49
https://git.kernel.org/stable/c/47ce611cb13f0eefa550d5434c1afcd4217bfc3e
https://git.kernel.org/stable/c/590fc6140e29c54d2f7839eb9df78d106ee1905e
https://git.kernel.org/stable/c/654b7e79443f5ea90849f5c1cf70c0d94bd5b10e
https://git.kernel.org/stable/c/743e7aeb9575c0838d8996d40d81a6b8fa5cd060
https://git.kernel.org/stable/c/9319706316a8e79f374627554386d575a84b637f

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-11 20:19

Updated : 2026-09-14 13:19

NVD link : CVE-2026-89605

Mitre link : CVE-2026-89605

CVE.ORG link : CVE-2026-89605

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-89605", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f66e883eb6186bc43a79581b67aff7d1a69d0ff1", "lessThan": "177e0c32fec3602bb3b64139bb8bb610cd6722c7", "versionType": "git"}, {"status": "affected", "version": "f66e883eb6186bc43a79581b67aff7d1a69d0ff1", "lessThan": "743e7aeb9575c0838d8996d40d81a6b8fa5cd060", "versionType": "git"}, {"status": "affected", "version": "f66e883eb6186bc43a79581b67aff7d1a69d0ff1", "lessThan": "590fc6140e29c54d2f7839eb9df78d106ee1905e", "versionType": "git"}, {"status": "affected", "version": "f66e883eb6186bc43a79581b67aff7d1a69d0ff1", "lessThan": "30845ed227475a11a49ccce047837d016b7e0f49", "versionType": "git"}, {"status": "affected", "version": "f66e883eb6186bc43a79581b67aff7d1a69d0ff1", "lessThan": "47ce611cb13f0eefa550d5434c1afcd4217bfc3e", "versionType": "git"}, {"status": "affected", "version": "f66e883eb6186bc43a79581b67aff7d1a69d0ff1", "lessThan": "9319706316a8e79f374627554386d575a84b637f", "versionType": "git"}, {"status": "affected", "version": "f66e883eb6186bc43a79581b67aff7d1a69d0ff1", "lessThan": "654b7e79443f5ea90849f5c1cf70c0d94bd5b10e", "versionType": "git"}, {"status": "affected", "version": "f66e883eb6186bc43a79581b67aff7d1a69d0ff1", "lessThan": "219644a3ad5518217b2d62cad6d2c36a2308c949", "versionType": "git"}], "programFiles": ["fs/ecryptfs/messaging.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.26"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.26", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.270", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.221", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.188", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.157", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.109", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.50", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.4", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/ecryptfs/messaging.c"], "defaultStatus": "affected"}]}], "published": "2026-09-11T20:19:45.487", "references": [{"url": "https://git.kernel.org/stable/c/177e0c32fec3602bb3b64139bb8bb610cd6722c7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/219644a3ad5518217b2d62cad6d2c36a2308c949", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/30845ed227475a11a49ccce047837d016b7e0f49", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/47ce611cb13f0eefa550d5434c1afcd4217bfc3e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/590fc6140e29c54d2f7839eb9df78d106ee1905e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/654b7e79443f5ea90849f5c1cf70c0d94bd5b10e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/743e7aeb9575c0838d8996d40d81a6b8fa5cd060", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9319706316a8e79f374627554386d575a84b637f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\necryptfs: release message context on send failure\n\necryptfs_send_message_locked() moves a message context from the free\nlist to the allocated list before sending the request to the userspace\ndaemon.\n\nIf ecryptfs_send_miscdev() fails, the context is left on the\nallocated list and cannot be reused. Move it back to the free list on\nfailure and clear the caller's pointer."}], "lastModified": "2026-09-14T13:19:14.590", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}