CVE-2026-53272

high

In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sbi->sync_decompress z_erofs_decompress_kickoff() can race w…

Vendor / product: Linux — linux kernel

In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sbi->sync_decompress z_erofs_decompress_kickoff() can race with filesystem unmount, causing a use-after-free on sbi->sync_decompress. When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff() to queue z_erofs_decompressqueue_work() asynchronously. Then, after all folios are unlocked, unmount workflow can proceed and sbi will be freed before accessing to sbi->sync_decompress. Thread (unmount) I/O completion kworker queue_work z_erofs_decompressqueue_work (all folios are unlocked) cleanup_mnt .. erofs_kill_sb erofs_sb_free kfree(sbi) access sbi->sync_decompress // UAF!!

CVSS

7.8

7.8 (CVSS v3.1)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2026-06-25 09:16

Modified: 2026-10-30 13:19

NVD status: Modified

Last synced 1 day ago

Verified against the source API 2026-10-30 13:38 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

linux / linux_kernel ≥5.17 <6.12.94, ≥6.13 <6.18.36, ≥6.19 <7.0.13, 7.1

Weakness classification (CWE)

CWE-416

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Patch / mitigation: https://git.kernel.org/stable/c/00bf6868df65fa95b3854996246d15759fdc7070

Patch / mitigation: https://git.kernel.org/stable/c/1aee05e814d292064bf5fa15733741040cdc48ba

Patch / mitigation: https://git.kernel.org/stable/c/86ab00cf81d44b675bb23db62b88fd76c8ac8cea

Patch / mitigation: https://git.kernel.org/stable/c/95caf60da33d87ed26c28993620f0d92487b0296

References

https://git.kernel.org/stable/c/00bf6868df65fa95b3854996246d15759fdc7070 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/1aee05e814d292064bf5fa15733741040cdc48ba 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5627e57f1da68ff0146896eb3d2eed25e62adc44 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/59db5d8bcc65e04d8598afd81ec3a18edb407470 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/86ab00cf81d44b675bb23db62b88fd76c8ac8cea 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/95caf60da33d87ed26c28993620f0d92487b0296 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Data sources

NVD CVE API 2.0 — fetched 2026-10-30 13:38 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-53272

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs