CVE-2026-68147: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68147 Overview

CVE-2026-68147 is a use-after-free vulnerability in the Linux kernel's filesystem encryption (fscrypt) subsystem. The flaw resides in fscrypt_get_devices(), which dynamically allocates an array to hold a filesystem's block device pointers. When fscrypt_destroy_inline_crypt_key() is invoked during inode eviction under direct reclaim, the allocation can fail. The function does not handle this failure and proceeds to zeroize and free the blk_crypto_key without calling blk_crypto_evict_key(), producing a use-after-free condition on the key structure.

Critical Impact
Local attackers with low privileges can trigger memory corruption in the Linux kernel through the fscrypt inline crypto path, potentially leading to privilege escalation or system compromise.

Affected Products

Linux kernel fs/crypto/ subsystem (fscrypt)
Filesystems using inline encryption, notably f2fs with multi-device configurations
Any kernel build enabling CONFIG_FS_ENCRYPTION_INLINE_CRYPT

Discovery Timeline

2026-08-10 - CVE-2026-68147 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68147

Vulnerability Analysis

The Linux kernel's fscrypt subsystem manages per-inode encryption keys for filesystems supporting inline block-layer crypto. When a blk_crypto_key begins usage or is evicted, fs/crypto/ calls fscrypt_get_devices() to enumerate the filesystem's block devices. The kernel then iterates and invokes blk_crypto_config_supported(), blk_crypto_start_using_key(), or blk_crypto_evict_key() on each device.

The device pointers are placed in a dynamically allocated array. This allocation can fail under memory pressure, particularly at fscrypt_destroy_inline_crypt_key() during inode eviction in direct reclaim. Because the caller does not check or handle the allocation failure, the key is freed without eviction from the block-crypto layer. The block layer retains a reference to memory that has been zeroized and released, resulting in a use-after-free [CWE-416].

Root Cause

The root cause is missing failure handling around dynamic memory allocation in a code path invoked during reclaim. fscrypt_destroy_inline_crypt_key() cannot fail cleanly because it must complete key teardown, yet the allocation it depends on may return NULL. Skipping blk_crypto_evict_key() leaves stale references pointing to freed key material.

Attack Vector

Exploitation requires local access with low privileges on a system using inline filesystem encryption. An attacker induces memory pressure to force allocation failure in fscrypt_get_devices() during inode eviction. The resulting use-after-free on the blk_crypto_key allocation may be leveraged to corrupt kernel memory. Successful exploitation could enable local privilege escalation.

The upstream fix replaces the dynamic allocation with an on-stack array. The multi-device fscrypt functionality is currently used only by f2fs, which hardcodes a maximum of 8 block devices, so a fixed-size stack array is sufficient. Fixes are distributed across commits including 4462ac3d90e8, 6fe4e4b8259e, 81ea8e822185, 97a688563be7, and bc2d630296e0.

Detection Methods for CVE-2026-68147

Indicators of Compromise

Kernel oops or KASAN reports referencing fscrypt_get_devices, fscrypt_destroy_inline_crypt_key, or blk_crypto_evict_key
Unexpected filesystem I/O errors on f2fs volumes with multi-device inline encryption enabled
Sudden system instability correlated with memory pressure events on hosts using fscrypt inline crypto

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface the use-after-free during fscrypt workloads under memory pressure
Audit running kernel versions against the fixed commits listed in the upstream stable tree
Monitor dmesg and journalctl -k for warnings originating from fs/crypto/inline_crypt.c

Monitoring Recommendations

Collect kernel logs centrally and alert on stack traces mentioning fscrypt or blk-crypto functions
Track kernel package versions across the fleet and flag hosts running unpatched builds
Correlate memory-pressure metrics with kernel fault events on systems running f2fs with encryption

How to Mitigate CVE-2026-68147

Immediate Actions Required

Update to a Linux kernel version that includes the fscrypt on-stack array fix from the stable tree
Restrict local shell access to trusted users on systems using inline filesystem encryption
Reduce sustained memory pressure on hosts running f2fs with multi-device inline crypto

Patch Information

The fix converts the dynamically allocated device array in fscrypt_get_devices() to an on-stack array, eliminating the allocation failure path. Apply the upstream patches referenced in the Linux stable commit 4462ac3d90e8, commit 6fe4e4b8259e, commit 81ea8e822185, commit 97a688563be7, and commit bc2d630296e0.

Workarounds

Disable inline filesystem encryption where feasible by mounting without inline crypto support
Avoid multi-device f2fs configurations with fscrypt enabled until the patched kernel is deployed
Enforce cgroup memory limits to reduce the likelihood of reaching direct reclaim on sensitive hosts

bash

# Verify running kernel version and check for the fix
uname -r
# Confirm patch presence in your distribution's changelog
rpm -q --changelog kernel | grep -i fscrypt   # RHEL-based
apt changelog linux-image-$(uname -r) | grep -i fscrypt  # Debian-based