The Linux kernel’s fscrypt subsystem has a flaw. When a block‑crypt key begins use or is evicted, the routine fscrypt_get_devices() builds a list of block device pointers in a dynamically allocated array. If the allocation fails, the code continues and later the inline key is destroyed without calling blk_crypto_evict_key(). The missing eviction leads to a dangling pointer that can be freed or referenced, resulting in a use‑after‑free that corrupts kernel memory. This weakness is characterized by CWE‑825.

Any Linux kernel image that has not yet incorporated the commit that replaces the heap allocation with an on‑stack array is affected. The multi‑device feature is currently exercised only by the f2fs filesystem, which has a hard‑coded limit of eight block devices. Therefore platforms running a pre‑patch kernel with f2fs mounted are the primary exposure. Other filesystems do not use this path today, but the mechanism could be leveraged by future kernels that enable additional block‑crypto‑device support.

The CVSS score of 7.8 indicates high severity. However, the EPSS score of <1% suggests that exploitation is unlikely in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local kernel access that can trigger the key‑eviction path. Based on the description, it is inferred that a locally privileged user who can force inline key destruction could trigger the use‑after‑free, potentially leading to kernel memory corruption, a crash, or, in a worst‑case scenario, privilege escalation.