In the Linux kernel, the ecryptfs module lacked a required list lock while cleaning a dying daemon’s queued messages. The function ecryptfs_exorcise_daemon() dropped queued messages without holding ecryptfs_msg_ctx_lists_mux, yet ecryptfs_msg_ctx_alloc_to_free() requires that lock. This oversight creates a race condition that could corrupt data or crash the system when the queued contexts are moved back to the free list, impacting data integrity and availability.

The vulnerability affects the Linux kernel (Linux:Linux) at all versions that contain the unpatched ecryptfs code. No specific version numbers are supplied, so any kernel with the legacy ecryptfs module is potentially impacted.

The CVSS score of 5.3 indicates medium severity. The EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the kernel-level nature of the vulnerability, it is inferred that exploiting this race would likely require local or privileged access; it is not explicitly stated that other attack vectors are possible. No publicly known exploits have been reported.