---
id: CVE-2026-68148
title: 'fscrypt: Add missing superblock check in find_or_insert_direct_key()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fscrypt: Add missing superblock check in find_or_insert_direct_key()

  The legacy 'fscrypt_direct_keys' table caches master keys that are used
  by v1 encryption policies …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-772
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 22e9947a4b2ba255888541bd0111cf00b9b16586 <
    965b5bc8cf5031225e057979ce660fec2bd5fbfc
  - >-
    Linux >= 22e9947a4b2ba255888541bd0111cf00b9b16586 <
    330249609b70778094a7a36f5b6bcfa6362121d4
  - >-
    Linux >= 22e9947a4b2ba255888541bd0111cf00b9b16586 <
    deff41898a5ae3a47db5fa1896a494aa95efda5d
  - >-
    Linux >= 22e9947a4b2ba255888541bd0111cf00b9b16586 <
    95376fe9c145be35566991df99c53134943d992f
  - >-
    Linux >= 22e9947a4b2ba255888541bd0111cf00b9b16586 <
    466f187b501a5ac8e1ea2ccf3ccd5c46108d8830
  - >-
    Linux >= 22e9947a4b2ba255888541bd0111cf00b9b16586 <
    b5fa40226e71c17847b9ff2816c6ca4133d0d994
  - Linux 6.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:44:51.705940Z'
published: '2026-08-10'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T20:58:54.031Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68148'
references:
  - url: 'https://git.kernel.org/stable/c/965b5bc8cf5031225e057979ce660fec2bd5fbfc'
  - url: 'https://git.kernel.org/stable/c/330249609b70778094a7a36f5b6bcfa6362121d4'
  - url: 'https://git.kernel.org/stable/c/deff41898a5ae3a47db5fa1896a494aa95efda5d'
  - url: 'https://git.kernel.org/stable/c/95376fe9c145be35566991df99c53134943d992f'
  - url: 'https://git.kernel.org/stable/c/466f187b501a5ac8e1ea2ccf3ccd5c46108d8830'
  - url: 'https://git.kernel.org/stable/c/b5fa40226e71c17847b9ff2816c6ca4133d0d994'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68148.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-68148'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2513211'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-68148'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68148'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026081001-CVE-2026-68148-7d8c@gregkh/T
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00092
epssPercentile: 0.00475
scores:
  cna: 7.8
  vendor: 7
ingestedAt: '2026-10-16T17:24:46.845Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fscrypt: Add missing superblock check in find_or_insert_direct_key()

The legacy 'fscrypt_direct_keys' table caches master keys that are used
by v1 encryption policies that have FSCRYPT_POLICY_FLAG_DIRECT_KEY.
It's just a global table for all filesystems (since the keys can be
provided by the legacy process-subscribed keyrings mechanism, which
makes it difficult to reuse super_block::s_master_keys).

The entries in it ('struct fscrypt_direct_key') do contain a super_block
pointer, though, for passing to fscrypt_destroy_inline_crypt_key() when
the last inode that references the key is evicted.

However, when finding the fscrypt_direct_key for an inode, we weren't
actually comparing the super_block pointer.  As a result, inodes with
different super_blocks could point to the same fscrypt_direct_key.  That
could extend the lifetime of a fscrypt_direct_key beyond the
super_block it points to, causing a use-after-free later.

Fix this by creating distinct fscrypt_direct_key structs for distinct
super_block structs.

Note that this problem doesn't exist in the v2 policy equivalent
("per-mode keys"), since the data structures there are per super_block.

## Affected

- `Linux >= 22e9947a4b2ba255888541bd0111cf00b9b16586 < 965b5bc8cf5031225e057979ce660fec2bd5fbfc`
- `Linux >= 22e9947a4b2ba255888541bd0111cf00b9b16586 < 330249609b70778094a7a36f5b6bcfa6362121d4`
- `Linux >= 22e9947a4b2ba255888541bd0111cf00b9b16586 < deff41898a5ae3a47db5fa1896a494aa95efda5d`
- `Linux >= 22e9947a4b2ba255888541bd0111cf00b9b16586 < 95376fe9c145be35566991df99c53134943d992f`
- `Linux >= 22e9947a4b2ba255888541bd0111cf00b9b16586 < 466f187b501a5ac8e1ea2ccf3ccd5c46108d8830`
- `Linux >= 22e9947a4b2ba255888541bd0111cf00b9b16586 < b5fa40226e71c17847b9ff2816c6ca4133d0d994`
- `Linux 6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68148.json)