CVE-2026-53129

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel Filesystem Cache

Publication date: 2026-06-24

Last updated on: 2026-07-06

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fs/mbcache: cancel shrink work before destroying the cache mb_cache_destroy() calls shrinker_free() and then frees all cache entries and the cache itself, but it does not cancel the pending c_shrink_work work item first. If mb_cache_entry_create() schedules c_shrink_work via schedule_work() and the work item is still pending or running when mb_cache_destroy() runs, mb_cache_shrink_worker() will access the cache after its memory has been freed, causing a use-after-free. This is only reachable by a privileged user (root or CAP_SYS_ADMIN) who can trigger the last put of a mounted ext2/ext4/ocfs2 filesystem. Cancel the work item with cancel_work_sync() before calling shrinker_free(), ensuring the worker has finished and will not be rescheduled before the cache is torn down.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-06

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-53129

EUVD

EUVD-2026-38997

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.33 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 4.6 (inc) to 6.12.91 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's filesystem cache management. Specifically, when the mb_cache_destroy() function is called, it frees the cache memory but does not cancel a pending work item called c_shrink_work. If this work item is still scheduled or running, it can access the cache after it has been freed, leading to a use-after-free condition.

This situation can only be triggered by a privileged user (root or with CAP_SYS_ADMIN capability) who can cause the last release of a mounted ext2, ext4, or ocfs2 filesystem. The fix involves cancelling the pending work item before freeing the cache to ensure no access occurs after memory is freed.

Impact Analysis

The vulnerability can lead to a use-after-free scenario in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker with privileged access to execute arbitrary code or escalate privileges.

However, exploitation requires privileged access (root or CAP_SYS_ADMIN), so it does not directly affect unprivileged users but poses a risk if an attacker gains such privileges.

Mitigation Strategies

This vulnerability can be mitigated by ensuring that the work item c_shrink_work is cancelled before the cache is destroyed.

Specifically, the fix involves calling cancel_work_sync() on the pending work item before calling shrinker_free(), which ensures the worker has finished and will not be rescheduled before the cache is torn down.

Additionally, only privileged users (root or CAP_SYS_ADMIN) can trigger this vulnerability, so limiting privileged access can reduce risk.

Hi! I’m here to help you understand CVE-2026-53129. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70