CVE-2026-89605

ecryptfs: release message context on send failure

State: Published
Severity: 7.8 High
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ecryptfs: release message context on send failure

ecryptfs_send_message_locked() moves a message context from the free list to the allocated list before sending the request to the userspace daemon.

If ecryptfs_send_miscdev() fails, the context is left on the allocated list and cannot be reused. Move it back to the free list on failure and clear the caller's pointer.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f66e883eb6186bc43a79581b67aff7d1a69d0ff1 to before 177e0c32fec3602bb3b64139bb8bb610cd6722c7Affected f66e883eb6186bc43a79581b67aff7d1a69d0ff1 to before 743e7aeb9575c0838d8996d40d81a6b8fa5cd060Affected f66e883eb6186bc43a79581b67aff7d1a69d0ff1 to before 590fc6140e29c54d2f7839eb9df78d106ee1905eAffected f66e883eb6186bc43a79581b67aff7d1a69d0ff1 to before 30845ed227475a11a49ccce047837d016b7e0f49Affected f66e883eb6186bc43a79581b67aff7d1a69d0ff1 to before 47ce611cb13f0eefa550d5434c1afcd4217bfc3eAffected f66e883eb6186bc43a79581b67aff7d1a69d0ff1 to before 9319706316a8e79f374627554386d575a84b637fAffected f66e883eb6186bc43a79581b67aff7d1a69d0ff1 to before 654b7e79443f5ea90849f5c1cf70c0d94bd5b10eAffected f66e883eb6186bc43a79581b67aff7d1a69d0ff1 to before 219644a3ad5518217b2d62cad6d2c36a2308c949Affected
LinuxLinux	2.6.26Affected before 2.6.26Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

f66e883eb6186bc43a79581b67aff7d1a69d0ff1 to before 177e0c32fec3602bb3b64139bb8bb610cd6722c7Affected
f66e883eb6186bc43a79581b67aff7d1a69d0ff1 to before 743e7aeb9575c0838d8996d40d81a6b8fa5cd060Affected
f66e883eb6186bc43a79581b67aff7d1a69d0ff1 to before 590fc6140e29c54d2f7839eb9df78d106ee1905eAffected
f66e883eb6186bc43a79581b67aff7d1a69d0ff1 to before 30845ed227475a11a49ccce047837d016b7e0f49Affected
f66e883eb6186bc43a79581b67aff7d1a69d0ff1 to before 47ce611cb13f0eefa550d5434c1afcd4217bfc3eAffected
f66e883eb6186bc43a79581b67aff7d1a69d0ff1 to before 9319706316a8e79f374627554386d575a84b637fAffected
f66e883eb6186bc43a79581b67aff7d1a69d0ff1 to before 654b7e79443f5ea90849f5c1cf70c0d94bd5b10eAffected
f66e883eb6186bc43a79581b67aff7d1a69d0ff1 to before 219644a3ad5518217b2d62cad6d2c36a2308c949Affected

LinuxLinux

2.6.26Affected
before 2.6.26Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.