The vulnerability is a missing superblock check in the fscrypt_direct_keys lookup function. Because the function does not compare the super_block pointer when retrieving a key, inodes from different filesystems can incorrectly share the same fscrypt_direct_key structure. This oversight can keep the key structure alive longer than the owning superblock, eventually leading to a use‑after‑free that corrupts kernel memory.

All Linux kernel releases that support the legacy v1 fscrypt encryption mode using FSCRYPT_POLICY_FLAG_DIRECT_KEY are affected. The newer v2 “per‑mode keys” implementation does not have the problem, as it uses per‑super_block key structures.

The CVSS score of 7.8 rates the flaw as moderate‑high severity, but the EPSS score of < 1 % indicates a very low estimated exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, exploitation would require a user to create or manipulate files on a filesystem that employs the vulnerable direct‑key mode and then cause the kernel to release a key structure prematurely. Successful exploitation could result in kernel memory corruption, potentially leading to a crash or privilege escalation, so the impact is significant if the flaw is realized.