GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89609 (GCVE-0-2026-89609)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-14 12:01
VLAI
Title
ecryptfs: hold msg ctx list lock when cleaning daemon queue
Summary
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfs_exorcise_daemon() drops queued messages from a dying daemon without holding ecryptfs_msg_ctx_lists_mux, but ecryptfs_msg_ctx_alloc_to_free() requires that lock. Take the list lock while moving the queued contexts back to the free list to avoid racing with other global msg ctx list users.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f66e883eb6186bc43a79581b67aff7d1a69d0ff1 , < 64d8998e36cfd2bb7114f3af0aa51c5a559a39b3 (git)
Affected: f66e883eb6186bc43a79581b67aff7d1a69d0ff1 , < 4d50b8aea11ad9594c8704a4c647e11311ab7b19 (git)
Affected: f66e883eb6186bc43a79581b67aff7d1a69d0ff1 , < 956541efd125a10442f9514668bc5c852702c93b (git)
Affected: f66e883eb6186bc43a79581b67aff7d1a69d0ff1 , < ec1627bcb5b51ddd46b1ef27a9d5a9834abb0a6a (git)
Affected: f66e883eb6186bc43a79581b67aff7d1a69d0ff1 , < 7e48afafe7abc275f7b6916613bb18b821e7d94a (git)
Affected: f66e883eb6186bc43a79581b67aff7d1a69d0ff1 , < 0d9636ecba34bd553ecf19049f7705505aea62fd (git)
Affected: f66e883eb6186bc43a79581b67aff7d1a69d0ff1 , < 4c02acbe0a2692ca9991c51e62bbe6d6b59dac31 (git)
Affected: f66e883eb6186bc43a79581b67aff7d1a69d0ff1 , < 779972513c2fa8c7938e54976f686091dafff22f (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.26
Unaffected: 0 , < 2.6.26 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ecryptfs/messaging.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "64d8998e36cfd2bb7114f3af0aa51c5a559a39b3",
              "status": "affected",
              "version": "f66e883eb6186bc43a79581b67aff7d1a69d0ff1",
              "versionType": "git"
            },
            {
              "lessThan": "4d50b8aea11ad9594c8704a4c647e11311ab7b19",
              "status": "affected",
              "version": "f66e883eb6186bc43a79581b67aff7d1a69d0ff1",
              "versionType": "git"
            },
            {
              "lessThan": "956541efd125a10442f9514668bc5c852702c93b",
              "status": "affected",
              "version": "f66e883eb6186bc43a79581b67aff7d1a69d0ff1",
              "versionType": "git"
            },
            {
              "lessThan": "ec1627bcb5b51ddd46b1ef27a9d5a9834abb0a6a",
              "status": "affected",
              "version": "f66e883eb6186bc43a79581b67aff7d1a69d0ff1",
              "versionType": "git"
            },
            {
              "lessThan": "7e48afafe7abc275f7b6916613bb18b821e7d94a",
              "status": "affected",
              "version": "f66e883eb6186bc43a79581b67aff7d1a69d0ff1",
              "versionType": "git"
            },
            {
              "lessThan": "0d9636ecba34bd553ecf19049f7705505aea62fd",
              "status": "affected",
              "version": "f66e883eb6186bc43a79581b67aff7d1a69d0ff1",
              "versionType": "git"
            },
            {
              "lessThan": "4c02acbe0a2692ca9991c51e62bbe6d6b59dac31",
              "status": "affected",
              "version": "f66e883eb6186bc43a79581b67aff7d1a69d0ff1",
              "versionType": "git"
            },
            {
              "lessThan": "779972513c2fa8c7938e54976f686091dafff22f",
              "status": "affected",
              "version": "f66e883eb6186bc43a79581b67aff7d1a69d0ff1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ecryptfs/messaging.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.26"
            },
            {
              "lessThan": "2.6.26",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\necryptfs: hold msg ctx list lock when cleaning daemon queue\n\necryptfs_exorcise_daemon() drops queued messages from a dying daemon\nwithout holding ecryptfs_msg_ctx_lists_mux, but\necryptfs_msg_ctx_alloc_to_free() requires that lock.\n\nTake the list lock while moving the queued contexts back to the free\nlist to avoid racing with other global msg ctx list users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The missing lock is reached only via local syscalls: close() of /dev/ecryptfs runs ecryptfs_miscdev_release() into ecryptfs_exorcise_daemon(), racing PKI open/create that calls ecryptfs_wait_for_response(); no network or adjacent protocol path exists.\nAC:L - The attacker owns both sides of the race: one thread does PKI file ops so wait_for_response() list_move()s a msg_ctx under ecryptfs_msg_ctx_lists_mux, while another closes /dev/ecryptfs so exorcise_daemon() list_move()s the same or sibling nodes without that lock.\nPR:L - ecryptfs_miscdev_open() has no capability check; daemons are per-euid. An unprivileged user reaches this by running ecryptfsd on /dev/ecryptfs and using an eCryptfs mount from setuid mount.ecryptfs_private or an encrypted home, with a user-keyring PRIVATE_KEY auth token.\nUI:N - The attacker registers their own daemon, installs their own auth token, uses their own eCryptfs directory, and issues the create/open/close syscalls; no other user needs to mount, open a file, or otherwise interact.\nS:U - Corrupted global msg_ctx lists and the double-free of msg_ctx-\u003emsg stay inside the host kernel\u0027s eCryptfs messaging subsystem; this is ordinary kernel impact, not a VM, IOMMU, or sandbox escape.\nC:H - Unlocked list_move() of a queued msg_ctx racing wait_for_response() is a use-after-free of the kmalloc\u0027d message buffer and leaves corrupted global list pointers that can be groomed to disclose kernel memory.\nI:H - The same race is a heap double-free of msg_ctx-\u003emsg plus unsynchronized list_move() writes through corrupted next/prev pointers, a classic memory-corruption primitive usable for control-flow hijacking.\nA:H - Concurrent unlocked list_move() readily oopses on LIST_POISON or a general protection fault during later list walks, and the double-free of msg_ctx-\u003emsg can panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:29.967Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/64d8998e36cfd2bb7114f3af0aa51c5a559a39b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d50b8aea11ad9594c8704a4c647e11311ab7b19"
        },
        {
          "url": "https://git.kernel.org/stable/c/956541efd125a10442f9514668bc5c852702c93b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec1627bcb5b51ddd46b1ef27a9d5a9834abb0a6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e48afafe7abc275f7b6916613bb18b821e7d94a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d9636ecba34bd553ecf19049f7705505aea62fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c02acbe0a2692ca9991c51e62bbe6d6b59dac31"
        },
        {
          "url": "https://git.kernel.org/stable/c/779972513c2fa8c7938e54976f686091dafff22f"
        }
      ],
      "title": "ecryptfs: hold msg ctx list lock when cleaning daemon queue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89609",
    "datePublished": "2026-09-11T19:45:11.086Z",
    "dateReserved": "2026-09-11T19:38:34.734Z",
    "dateUpdated": "2026-09-14T12:01:29.967Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89609",
      "date": "2026-09-16",
      "epss": "0.00176",
      "percentile": "0.07358"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-15T01:54:16.000Z",
      "cve": "CVE-2026-89609",
      "id": "msrc_CVE-2026-89609",
      "initial_release_date": "2026-09-13T01:04:45.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ecryptfs: hold msg ctx list lock when cleaning daemon queue",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89609.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89609\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:45.983\",\"lastModified\":\"2026-09-14T13:19:15.237\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\necryptfs: hold msg ctx list lock when cleaning daemon queue\\n\\necryptfs_exorcise_daemon() drops queued messages from a dying daemon\\nwithout holding ecryptfs_msg_ctx_lists_mux, but\\necryptfs_msg_ctx_alloc_to_free() requires that lock.\\n\\nTake the list lock while moving the queued contexts back to the free\\nlist to avoid racing with other global msg ctx list users.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ecryptfs/messaging.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f66e883eb6186bc43a79581b67aff7d1a69d0ff1\",\"lessThan\":\"64d8998e36cfd2bb7114f3af0aa51c5a559a39b3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f66e883eb6186bc43a79581b67aff7d1a69d0ff1\",\"lessThan\":\"4d50b8aea11ad9594c8704a4c647e11311ab7b19\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f66e883eb6186bc43a79581b67aff7d1a69d0ff1\",\"lessThan\":\"956541efd125a10442f9514668bc5c852702c93b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f66e883eb6186bc43a79581b67aff7d1a69d0ff1\",\"lessThan\":\"ec1627bcb5b51ddd46b1ef27a9d5a9834abb0a6a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f66e883eb6186bc43a79581b67aff7d1a69d0ff1\",\"lessThan\":\"7e48afafe7abc275f7b6916613bb18b821e7d94a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f66e883eb6186bc43a79581b67aff7d1a69d0ff1\",\"lessThan\":\"0d9636ecba34bd553ecf19049f7705505aea62fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f66e883eb6186bc43a79581b67aff7d1a69d0ff1\",\"lessThan\":\"4c02acbe0a2692ca9991c51e62bbe6d6b59dac31\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f66e883eb6186bc43a79581b67aff7d1a69d0ff1\",\"lessThan\":\"779972513c2fa8c7938e54976f686091dafff22f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ecryptfs/messaging.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.26\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.26\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0d9636ecba34bd553ecf19049f7705505aea62fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4c02acbe0a2692ca9991c51e62bbe6d6b59dac31\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4d50b8aea11ad9594c8704a4c647e11311ab7b19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/64d8998e36cfd2bb7114f3af0aa51c5a559a39b3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/779972513c2fa8c7938e54976f686091dafff22f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7e48afafe7abc275f7b6916613bb18b821e7d94a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/956541efd125a10442f9514668bc5c852702c93b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ec1627bcb5b51ddd46b1ef27a9d5a9834abb0a6a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:59:06+00:00",
      "cve": "CVE-2026-89609",
      "id": "CVE-2026-89609",
      "initial_release_date": "2026-09-11T19:45:11.086000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux Kernel: eCryptfs race condition in daemon queue cleanup",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89609.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-13T16:58:07Z",
      "cve": "CVE-2026-89609",
      "id": "CVE-2026-89609",
      "initial_release_date": "2026-09-12T16:25:09Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89609",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89609.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.