CVE-2026-68147

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the fscrypt component where the fscrypt get devices() function uses a dynamically allocated array to store block device pointers. This allocation can fail, particularly when fscrypt destroy inline crypt key() is called during inode eviction under direct reclaim. Because fscrypt destroy inline crypt key() does not properly handle this allocation failure, it may zeroize and free the blk crypto key without calling blk crypto evict key(), leading to a use-after-free condition. A use-after-free is a scenario where a program continues to use a pointer after the memory it points to has been freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.