EUVD-2026-76517
GHSA-3wv2-w328-38h2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only (AV:L), low-privilege user needed (PR:L); inducing controlled send failure and exploiting stale pointer against kernel heap requires elevated complexity (AC:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ecryptfs: release message context on send failure
ecryptfs_send_message_locked() moves a message context from the free list to the allocated list before sending the request to the userspace daemon.
If ecryptfs_send_miscdev() fails, the context is left on the allocated list and cannot be reused. Move it back to the free list on failure and clear the caller's pointer.
AnalysisAI
Resource management failure in the Linux kernel eCryptfs subsystem allows a local authenticated user to trigger a message context leak - and potentially exploit a stale pointer condition - by inducing send failures to the eCryptfs userspace daemon. The ecryptfs_send_message_locked() function moves a context from the free list to the allocated list before calling ecryptfs_send_miscdev(); on failure, it omits the rollback, leaving the context permanently stranded and the caller holding a dangling reference. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) a local user account on the target system, (2) the ecryptfs kernel module loaded and an eCryptfs filesystem actively mounted with its userspace daemon running, and (3) the ability to induce ecryptfs_send_miscdev() failures - for example, by disrupting the /dev/ecryptfs miscdev interface or terminating the daemon. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) characterizes this as a local privilege escalation path, inferring that the stale pointer left by the bug can be exploited for use-after-free primitives to achieve C:H/I:H/A:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released kernel patches: upgrade to Linux 6.12.109, 6.18.50, 7.2.4, or any release based on 7.3-rc1 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify Linux systems running affected kernel versions (6.12.x, 6.18.x, 7.2.x) that use eCryptfs for filesystem encryption. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today