CVE-2026-89605: Linux Kernel eCryptfs Resource Leak Vulnerability

CVE-2026-89605 Overview

CVE-2026-89605 is a Linux kernel vulnerability in the eCryptfs stacked cryptographic filesystem. The flaw resides in ecryptfs_send_message_locked(), which moves a message context from the free list to the allocated list before sending a request to the userspace daemon. When ecryptfs_send_miscdev() fails, the context is left stranded on the allocated list and cannot be reused.

The upstream fix restores the context to the free list on failure and clears the caller's pointer. Repeated failures can exhaust the message context pool and destabilize the kernel's eCryptfs subsystem.

Critical Impact
A local, low-privileged user interacting with eCryptfs can trigger repeated send failures to exhaust the kernel message context pool, impacting confidentiality, integrity, and availability of the encrypted filesystem operations.

Affected Products

Linux kernel builds with the eCryptfs filesystem (CONFIG_ECRYPT_FS) enabled
Multiple stable branches referenced by upstream commits including 177e0c32, 219644a3, 30845ed2, 47ce611c, 590fc614, 654b7e79, 743e7aeb, and 93197063
Distributions shipping vulnerable kernels prior to backporting the eCryptfs message context fix

Discovery Timeline

2026-09-11 - CVE-2026-89605 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89605

Vulnerability Analysis

The eCryptfs subsystem maintains a bounded pool of message contexts used to coordinate cryptographic operations between the kernel and a userspace daemon. ecryptfs_send_message_locked() allocates a context by moving it from the free list to the allocated list before dispatching the request through ecryptfs_send_miscdev().

When the miscdev send path returns an error, the original code did not roll back the list transition. The context remained on the allocated list indefinitely, and the caller retained a dangling pointer to a resource it believed had failed cleanly. Repeated invocations drain the finite context pool, degrading eCryptfs operations for all users on the system.

The attack surface requires local access with the ability to invoke eCryptfs operations. Because the bug affects a shared kernel resource, exploitation impacts the confidentiality, integrity, and availability of encrypted filesystem I/O across the host.

Root Cause

The root cause is missing error-path cleanup, a resource-management defect classifiable as a memory/resource leak. The function transitions state (list membership) before performing a fallible operation but omits compensating logic on failure. This leaves kernel data structures in an inconsistent state and prevents reuse of the leaked context.

Attack Vector

A local attacker with permission to trigger eCryptfs message dispatch can repeatedly induce ecryptfs_send_miscdev() failures, for example by manipulating the userspace daemon connection state. Each failure leaks one message context. Sustained triggering exhausts the pool and produces denial-of-service conditions or unexpected behavior in encrypted mount operations.

No verified public exploit code is available. See the upstream patch commits for the corrected error-handling logic.

Detection Methods for CVE-2026-89605

Indicators of Compromise

Recurring ecryptfs_send_miscdev() failure messages in dmesg or the kernel ring buffer
Growing count of allocated eCryptfs message contexts without corresponding completions
Stalled or failing operations on eCryptfs mounts under otherwise normal system load

Detection Strategies

Audit running kernel versions against the fixed commit hashes (177e0c32, 219644a3, 30845ed2, 47ce611c, 590fc614, 654b7e79, 743e7aeb, 93197063) to identify unpatched hosts
Monitor eCryptfs-related syscall failure rates from processes that mount or access encrypted directories
Correlate spikes in eCryptfs daemon (ecryptfsd) disconnects with kernel warnings about message dispatch

Monitoring Recommendations

Enable kernel audit logging for eCryptfs mount, unmount, and message operations
Track long-running processes issuing repeated failed eCryptfs requests from a single UID
Alert on kernel log patterns indicating resource exhaustion in filesystem subsystems

How to Mitigate CVE-2026-89605

Immediate Actions Required

Apply the vendor kernel update that includes the eCryptfs message context release fix from the referenced stable commits
Inventory hosts with CONFIG_ECRYPT_FS enabled and prioritize patching multi-user or shared systems
Restrict local shell and container access on unpatched systems until the fix is deployed

Patch Information

The fix moves the leaked context back to the free list and clears the caller's pointer when ecryptfs_send_miscdev() fails. Distribution kernels should incorporate one of the upstream commits listed in the Linux Kernel Commit 590fc614 reference and the seven sibling backports. Consult your distribution's security advisories for exact package versions.

Workarounds

Unmount and disable eCryptfs mounts where feasible until a patched kernel is installed
Blacklist the ecryptfs module (modprobe -r ecryptfs and add to /etc/modprobe.d/) on systems that do not require it
Limit which local users can invoke eCryptfs helpers such as mount.ecryptfs_private through filesystem permissions

bash

# Configuration example: prevent eCryptfs module load on hosts that do not need it
echo 'blacklist ecryptfs' | sudo tee /etc/modprobe.d/disable-ecryptfs.conf
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep ecryptfs || echo 'ecryptfs not loaded'