EUVD-2026-76521
GHSA-c77f-5fp9-7h2f
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires timing control (AC:H); local eCryptfs access needed (PR:L, AV:L); full memory corruption impact supports C:H/I:H/A:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ecryptfs: hold msg ctx list lock when cleaning daemon queue
ecryptfs_exorcise_daemon() drops queued messages from a dying daemon without holding ecryptfs_msg_ctx_lists_mux, but ecryptfs_msg_ctx_alloc_to_free() requires that lock.
Take the list lock while moving the queued contexts back to the free list to avoid racing with other global msg ctx list users.
AnalysisAI
Missing lock acquisition in the eCryptfs filesystem layer exposes the global message context list to concurrent modification during daemon teardown. In ecryptfs_exorcise_daemon(), queued message contexts are moved back to the free list without holding ecryptfs_msg_ctx_lists_mux, while ecryptfs_msg_ctx_alloc_to_free() and other list consumers require that lock - creating a race window for use-after-free or memory corruption reachable by a local user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | eCryptfs must be actively mounted on the target system (e.g., encrypted home directory via ecryptfs-utils, common on Ubuntu). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects the full C/I/A impact plausibly resulting from memory corruption, but AC:L appears overstated for a race condition - exploiting a specific locking window reliably requires timing control, which typically warrants AC:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released stable kernel updates: upgrade to Linux 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (mainline), which add lock acquisition around the message context list traversal in `ecryptfs_exorcise_daemon()`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running eCryptfs using mount | grep ecryptfs and document the scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today