CVE-2026-68148

In the Linux kernel, the following vulnerability has been resolved:

fscrypt: Add missing superblock check in findorinsertdirectkey()

The legacy 'fscryptdirectkeys' table caches master keys that are used by v1 encryption policies that have FSCRYPTPOLICYFLAGDIRECTKEY. It's just a global table for all filesystems (since the keys can be provided by the legacy process-subscribed keyrings mechanism, which makes it difficult to reuse superblock::smaster_keys).

The entries in it ('struct fscryptdirectkey') do contain a superblock pointer, though, for passing to fscryptdestroyinlinecrypt_key() when the last inode that references the key is evicted.

However, when finding the fscryptdirectkey for an inode, we weren't actually comparing the superblock pointer. As a result, inodes with different superblocks could point to the same fscryptdirectkey. That could extend the lifetime of a fscryptdirectkey beyond the super_block it points to, causing a use-after-free later.

Fix this by creating distinct fscryptdirectkey structs for distinct super_block structs.

Note that this problem doesn't exist in the v2 policy equivalent ("per-mode keys"), since the data structures there are per super_block.