The fault lies in the fscrypt subsystem of the Linux kernel, where a dynamically allocated array is used to store block–device pointers during key usage or eviction. The allocation can fail, and the code does not detect this failure; when the key is subsequently destroyed, the code attempts to free the unused array without having performed the proper eviction call, leading to a use‑after‑free situation. If an attacker can induce the eviction path (for instance, by manipulating file‑system quanta or triggering inline key destruction), they could corrupt kernel memory, potentially resulting in local privilege escalation or denial of service.

The defect exists in any Linux kernel image that has not yet incorporated the commit that replaces the dynamic allocation with an on‑stack array. In practice, the vulnerable path is exercised only when the f2fs filesystem is present, as it is the only filesystem that currently invokes this multi‑device code. Therefore any system running a pre‑patch kernel with f2fs mounted may be impacted.

No CVSS score is provided and the EPSS score is unavailable; the vulnerability is not listed in CISA KEV. Nevertheless, a use‑after‑free that can corrupt kernel memory is a high‑impact flaw that can be exploited locally if an attacker can trigger the key eviction workflow. While exploitation requires kernel access, it could allow arbitrary kernel code execution or a forced kernel panic, depending on the attacker’s goals and the system state.