ecryptfs MsgCtx Leak

Vulnerability analysis

When ecryptfs sends a request to its userspace daemon, it moves a message context from the free pool to the allocated list before attempting the send. If the send fails, the context is stranded on the allocated list and never returned to the free pool, permanently reducing the available context count. Repeated failures exhaust all contexts, blocking all subsequent ecryptfs key operations and effectively denying service to every user of the filesystem. The fix moves the context back to the free list and clears the caller's reference when a send error occurs, restoring the pool to its prior state. The vulnerable path is reachable by any local user who can perform file operations on a mounted ecryptfs filesystem, provided the userspace daemon is absent or failing; mounting the filesystem itself requires administrator privileges, but the triggering operations do not.