CVE-2026-53272
Received Received - Intake
Use-After-Free in EROFS Linux Kernel

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sbi->sync_decompress z_erofs_decompress_kickoff() can race with filesystem unmount, causing a use-after-free on sbi->sync_decompress. When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff() to queue z_erofs_decompressqueue_work() asynchronously. Then, after all folios are unlocked, unmount workflow can proceed and sbi will be freed before accessing to sbi->sync_decompress. Thread (unmount) I/O completion kworker queue_work z_erofs_decompressqueue_work (all folios are unlocked) cleanup_mnt .. erofs_kill_sb erofs_sb_free kfree(sbi) access sbi->sync_decompress // UAF!!
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-53272
EUVD
EUVD-2026-39223
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel erofs *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's erofs filesystem. Specifically, the function z_erofs_decompress_kickoff() can race with the filesystem unmount process, leading to a situation where the sbi->sync_decompress object is accessed after it has been freed.

The problem occurs because when I/O completes, z_erofs_endio() queues asynchronous work via z_erofs_decompressqueue_work(). Meanwhile, the unmount process can proceed to free the sbi structure before this queued work accesses sbi->sync_decompress, causing a use-after-free error.

Impact Analysis

This use-after-free vulnerability can lead to undefined behavior in the kernel, such as system crashes, data corruption, or potential escalation of privileges if exploited. Since it involves accessing freed memory, it may cause kernel instability or allow attackers to execute arbitrary code within the kernel context.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53272. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart