# CVE-2026-68147: fscrypt: Avoid dynamic allocation in fscrypt_get_devices()

CVE-2026-68147 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-68147, released August 11, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-68147
- Priority: High
- CVSS: 7.8 (Moderate)
- EPSS: 0.0014
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 10, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68147

## Description

In the Linux kernel, the following vulnerability has been resolved:  fscrypt: Avoid dynamic allocation in fscrypt_get_devices()  When a blk_crypto_key starts being used or is evicted, fs/crypto/ calls fscrypt_get_devices() to get the filesystem's list of block devices, then iterates over them and calls blk_crypto_config_supported(), blk_crypto_start_using_key(), or blk_crypto_evict_key() on each one.  Currently, the block device pointers are placed in a dynamically allocated array.  This dynamic allocation is problematic because:  - It can fail, especially at the fscrypt_destroy_inline_crypt_key() call   site when it's invoked for inode eviction under direct reclaim.  - fscrypt_destroy_inline_crypt_key() doesn't handle the failure.  It   just zeroizes and frees the blk_crypto_key without calling   blk_crypto_evict_key().  That causes a use-after-free.  For now, let's fix this in the straightforward and easily-backportable way by switching to an on-stack array.  Currently the fscrypt multi-device functionality is used only by f2fs, which has a hardcoded limit of 8 block devices.  An on-stack array works fine for that.  (Of course, this solution won't scale up to large number of block devices.  For that we'd need a different solution, like moving the block device iteration into the filesystem.  Or in the case of btrfs, which will only support blk-crypto-fallback, we should make it just call blk-crypto-fallback directly, so the block devices won't be needed.)

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.187-1 | [DEBIAN-CVE-2026-68147](https://patchblox.com/security/data/fix/linux/debian-cve-2026-68147.md) | Aug 11, 2026 |
| Linux | linux Debian 13.5 (trixie) | 6.12.101-1 | [DEBIAN-CVE-2026-68147](https://patchblox.com/security/data/fix/linux/debian-cve-2026-68147.md) | Aug 11, 2026 |
| Linux | linux Debian 14 | 7.1.6-1 | [DEBIAN-CVE-2026-68147](https://patchblox.com/security/data/fix/linux/debian-cve-2026-68147.md) | Aug 11, 2026 |
| Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.101-1~deb12u1 | [DEBIAN-CVE-2026-68147](https://patchblox.com/security/data/fix/linux/debian-cve-2026-68147.md) | Aug 11, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.