{"id":"CVE-2026-89605","title":"ecryptfs: release message context on send failure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\necryptfs: release message context on send failure\n\necryptfs_send_message_locked() moves a message context from the free\nlist to the allocated list before sending the re…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-772"],"vendor":"Linux","product":"Linux","affected":["Linux >= f66e883eb6186bc43a79581b67aff7d1a69d0ff1 < 177e0c32fec3602bb3b64139bb8bb610cd6722c7","Linux >= f66e883eb6186bc43a79581b67aff7d1a69d0ff1 < 743e7aeb9575c0838d8996d40d81a6b8fa5cd060","Linux >= f66e883eb6186bc43a79581b67aff7d1a69d0ff1 < 590fc6140e29c54d2f7839eb9df78d106ee1905e","Linux >= f66e883eb6186bc43a79581b67aff7d1a69d0ff1 < 30845ed227475a11a49ccce047837d016b7e0f49","Linux >= f66e883eb6186bc43a79581b67aff7d1a69d0ff1 < 47ce611cb13f0eefa550d5434c1afcd4217bfc3e","Linux >= f66e883eb6186bc43a79581b67aff7d1a69d0ff1 < 9319706316a8e79f374627554386d575a84b637f","Linux >= f66e883eb6186bc43a79581b67aff7d1a69d0ff1 < 654b7e79443f5ea90849f5c1cf70c0d94bd5b10e","Linux >= f66e883eb6186bc43a79581b67aff7d1a69d0ff1 < 219644a3ad5518217b2d62cad6d2c36a2308c949","Linux 2.6.26"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:49:36.445Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89605","references":[{"url":"https://git.kernel.org/stable/c/177e0c32fec3602bb3b64139bb8bb610cd6722c7"},{"url":"https://git.kernel.org/stable/c/743e7aeb9575c0838d8996d40d81a6b8fa5cd060"},{"url":"https://git.kernel.org/stable/c/590fc6140e29c54d2f7839eb9df78d106ee1905e"},{"url":"https://git.kernel.org/stable/c/30845ed227475a11a49ccce047837d016b7e0f49"},{"url":"https://git.kernel.org/stable/c/47ce611cb13f0eefa550d5434c1afcd4217bfc3e"},{"url":"https://git.kernel.org/stable/c/9319706316a8e79f374627554386d575a84b637f"},{"url":"https://git.kernel.org/stable/c/654b7e79443f5ea90849f5c1cf70c0d94bd5b10e"},{"url":"https://git.kernel.org/stable/c/219644a3ad5518217b2d62cad6d2c36a2308c949"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89605.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89605"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532190"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89605"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89605"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89605.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00169,"epssPercentile":0.06187,"scores":{"cna":7.8,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.451Z","slug":"CVE-2026-89605","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\necryptfs: release message context on send failure\n\necryptfs_send_message_locked() moves a message context from the free\nlist to the allocated list before sending the request to the userspace\ndaemon.\n\nIf ecryptfs_send_miscdev() fails, the context is left on the\nallocated list and cannot be reused. Move it back to the free list on\nfailure and clear the caller's pointer.\n\n## Affected\n\n- `Linux >= f66e883eb6186bc43a79581b67aff7d1a69d0ff1 < 177e0c32fec3602bb3b64139bb8bb610cd6722c7`\n- `Linux >= f66e883eb6186bc43a79581b67aff7d1a69d0ff1 < 743e7aeb9575c0838d8996d40d81a6b8fa5cd060`\n- `Linux >= f66e883eb6186bc43a79581b67aff7d1a69d0ff1 < 590fc6140e29c54d2f7839eb9df78d106ee1905e`\n- `Linux >= f66e883eb6186bc43a79581b67aff7d1a69d0ff1 < 30845ed227475a11a49ccce047837d016b7e0f49`\n- `Linux >= f66e883eb6186bc43a79581b67aff7d1a69d0ff1 < 47ce611cb13f0eefa550d5434c1afcd4217bfc3e`\n- `Linux >= f66e883eb6186bc43a79581b67aff7d1a69d0ff1 < 9319706316a8e79f374627554386d575a84b637f`\n- `Linux >= f66e883eb6186bc43a79581b67aff7d1a69d0ff1 < 654b7e79443f5ea90849f5c1cf70c0d94bd5b10e`\n- `Linux >= f66e883eb6186bc43a79581b67aff7d1a69d0ff1 < 219644a3ad5518217b2d62cad6d2c36a2308c949`\n- `Linux 2.6.26`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 6 · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89605.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224680,"id":"CVE-2026-89605","ts":1792401470773,"field":"cvss","old":"5.5","new":"7.8"},{"seq":224679,"id":"CVE-2026-89605","ts":1792401470773,"field":"severity","old":"medium","new":"high"},{"seq":208123,"id":"CVE-2026-89605","ts":1789922721673,"field":"cvss","old":"7.8","new":"5.5"},{"seq":208122,"id":"CVE-2026-89605","ts":1789922721673,"field":"severity","old":"high","new":"medium"},{"seq":197876,"id":"CVE-2026-89605","ts":1789384320774,"field":"cvss","old":"5.5","new":"7.8"},{"seq":197875,"id":"CVE-2026-89605","ts":1789384320774,"field":"severity","old":"medium","new":"high"},{"seq":183425,"id":"CVE-2026-89605","ts":1789356675317,"field":"cvss","old":"7.8","new":"5.5"},{"seq":183424,"id":"CVE-2026-89605","ts":1789356675317,"field":"severity","old":"high","new":"medium"},{"seq":153428,"id":"CVE-2026-89605","ts":1789285350472,"field":"cvss","old":null,"new":"7.8"},{"seq":153427,"id":"CVE-2026-89605","ts":1789285350472,"field":"severity","old":"none","new":"high"},{"seq":147600,"id":"CVE-2026-89605","ts":1789270211547,"field":"cvss","old":null,"new":"5.5"},{"seq":147599,"id":"CVE-2026-89605","ts":1789270211547,"field":"severity","old":"none","new":"medium"},{"seq":109366,"id":"CVE-2026-89605","ts":1789183731630,"field":"cvss","old":null,"new":"5.5"},{"seq":109365,"id":"CVE-2026-89605","ts":1789183731630,"field":"severity","old":"none","new":"medium"}]}