CVE-2026-68148

A moderate use-after-free vulnerability in the Linux kernel's fscrypt (filesystem encryption) subsystem affects Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS. The legacy global fscrypt_direct_keys table caches master keys used by v1 encryption policies that specify FSCRYPT_POLICY_FLAG_DIRECT_KEY. When find_or_insert_direct_key() looked up the direct key for an inode, it did not compare the super_block pointer, so inodes from different filesystems could reference the same fscrypt_direct_key structure. This could extend the lifetime of that structure beyond the lifetime of the superblock it points to, causing a use-after-free when the key is later destroyed. A local attacker able to use fscrypt with v1 direct-key policies on multiple filesystems could potentially exploit this flaw to cause a denial of service, disclose sensitive information, or execute arbitrary code; however, the specific conditions required make exploitation difficult, and Red Hat has assessed the attack complexity as high. Only filesystems that use legacy v1 encryption policies with the direct-key flag are exposed to this flaw; v2 encryption policies are not affected because their per-mode keys are maintained in per-superblock data structures. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in their kernels. A fix for the affected products is being pursued by the Red Hat kernel team. Red Hat rates this flaw as Moderate severity, while the upstream CVE record assigns a CVSS 3.1 base score of 7.8 (Important); this difference reflects the high attack complexity and the limited set of configurations that use v1 direct-key encryption policies.