CVE-2026-68147

A flaw was found in the Linux kernel's fscrypt component. When a cryptographic key (blk_crypto_key) is being evicted, the system attempts to dynamically allocate memory. If this allocation fails, the key may be freed prematurely without proper eviction, leading to a use-after-free vulnerability. This could potentially allow a local attacker to cause a system crash or escalate privileges.

This vulnerability is rated Moderate due to the requirement for local access and the high complexity of inducing a direct reclaim memory allocation failure during cryptographic key eviction. Exploitation is further constrained as multi-device fscrypt handling is restricted to specific filesystems, such as F2FS, which are not standard in Red Hat Enterprise Linux deployments. Furthermore, supported Red Hat Enterprise Linux kernels do not include the vulnerable commit that introduced this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.