A race condition vulnerability in the Linux kernel eCryptfs module could allow a local authenticated attacker to achieve full system compromise.

This is a race condition (CWE-362) occurring within the eCryptfs subsystem, where the ecryptfs_exorcise_daemon function fails to acquire the necessary ecryptfs_msg_ctx_lists_mux lock when cleaning the daemon queue. This flaw requires a local attacker with low privileges to trigger the race, potentially leading to unauthorized memory access or system instability.

A successful exploit of this vulnerability could result in privilege escalation, unauthorized data access, or denial of service by crashing the kernel. With a CVSS score of 7.8, the vulnerability is classified as High severity, reflecting the potential for a local attacker to bypass security boundaries and gain control over the underlying operating system. Organizations relying on eCryptfs for encrypted file systems are at elevated risk.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panics or repeated service failures related to eCryptfs, which may indicate attempted exploitation.

Compensating Controls: Restrict local shell access to untrusted users and ensure that kernel hardening features, such as disabling unnecessary modules, are enforced via system configuration.

Public Exploit Available: No confirmed public exploit exists in the provided data.

Given the potential for local privilege escalation, this vulnerability should be prioritized for patching on all multi-user systems or environments where untrusted local access is possible. Administrators should verify their kernel version and apply the upstream patches provided by the Linux kernel stable repository as soon as they are integrated into their specific distribution.