{"id":"CVE-2026-68148","revision":"c347168891d9403580fec4bab72ba702","records":[{"revision":"c347168891d9403580fec4bab72ba702","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68148","aliases":[],"title":"fscrypt: Add missing superblock check in find_or_insert_direct_key()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfscrypt: Add missing superblock check in find_or_insert_direct_key()\n\nThe legacy 'fscrypt_direct_keys' table caches master keys that are used\nby v1 encryption policies that have FSCRYPT_POLICY_FLAG_DIRECT_KEY.\nIt's just a global table for all filesystems (since the keys can be\nprovided by the legacy process-subscribed keyrings mechanism, which\nmakes it difficult to reuse super_block::s_master_keys).\n\nThe entries in it ('struct fscrypt_direct_key') do contain a super_block\npointer, though, for passing to fscrypt_destroy_inline_crypt_key() when\nthe last inode that references the key is evicted.\n\nHowever, when finding the fscrypt_direct_key for an inode, we weren't\nactually comparing the super_block pointer.  As a result, inodes with\ndifferent super_blocks could point to the same fscrypt_direct_key.  That\ncould extend the lifetime of a fscrypt_direct_key beyond the\nsuper_block it points to, causing a use-after-free later.\n\nFix this by creating distinct fscrypt_direct_key structs for distinct\nsuper_block structs.\n\nNote that this problem doesn't exist in the v2 policy equivalent\n(\"per-mode keys\"), since the data structures there are per super_block.","state":0,"publishedAt":"2026-08-10T11:59:13.413+00:00","modifiedAt":"2026-10-19T20:58:54.031+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/crypto/keysetup_v1.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"22e9947a4b2ba255888541bd0111cf00b9b16586\",\n                            \"lessThan\": \"965b5bc8cf5031225e057979ce660fec2bd5fbfc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"22e9947a4b2ba255888541bd0111cf00b9b16586\",\n                            \"lessThan\": \"330249609b70778094a7a36f5b6bcfa6362121d4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"22e9947a4b2ba255888541bd0111cf00b9b16586\",\n                            \"lessThan\": \"deff41898a5ae3a47db5fa1896a494aa95efda5d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"22e9947a4b2ba255888541bd0111cf00b9b16586\",\n                            \"lessThan\": \"95376fe9c145be35566991df99c53134943d992f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"22e9947a4b2ba255888541bd0111cf00b9b16586\",\n                            \"lessThan\": \"466f187b501a5ac8e1ea2ccf3ccd5c46108d8830\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"22e9947a4b2ba255888541bd0111cf00b9b16586\",\n                            \"lessThan\": \"b5fa40226e71c17847b9ff2816c6ca4133d0d994\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/crypto/keysetup_v1.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.148\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.101\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.42\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/965b5bc8cf5031225e057979ce660fec2bd5fbfc","https://git.kernel.org/stable/c/330249609b70778094a7a36f5b6bcfa6362121d4","https://git.kernel.org/stable/c/deff41898a5ae3a47db5fa1896a494aa95efda5d","https://git.kernel.org/stable/c/95376fe9c145be35566991df99c53134943d992f","https://git.kernel.org/stable/c/466f187b501a5ac8e1ea2ccf3ccd5c46108d8830","https://git.kernel.org/stable/c/b5fa40226e71c17847b9ff2816c6ca4133d0d994"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68148","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68148","identifiers":["CVE-2026-68148"]},"retained":false,"historicalAffected":[]}],"coverage":[]}