ecryptfs DaemonQueue Race

Vulnerability analysis

When an eCryptfs daemon process dies, the kernel moves its queued message contexts back to the global free list. The original code performs this cleanup without holding the lock that protects that global list, so it can race with concurrent operations that allocate or free message contexts during normal encrypted file I/O. This unsynchronized list manipulation can corrupt the linked list, leading to use-after-free conditions and kernel memory corruption. The fix acquires the global list lock around the entire cleanup loop, ensuring the daemon's queued contexts are moved back to the free list atomically with respect to other list users. The vulnerable path is reachable locally by any user who can perform file operations on an existing eCryptfs mount, which requires the filesystem to have been set up by an administrator; the race window opens when the daemon process exits or is killed while I/O is in flight.