CVE-2026-53381

Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in Linux Kernel virtiofs

Publication date: 2026-07-19

Last updated on: 2026-07-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput() called from fuse_release_end() can Oops if the super block has already been destroyed. Normally this is prevented by waiting for num_waiting to go down to zero before commencing with super block shutdown. This only works, however, for the last submount instance, as the wait counter is per connection, not per superblock. Revert to using synchronous release requests for the auto_submounts case, which is virtiofs only at this time.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-07-29

Generated

2026-08-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-08

NVD

CVE-2026-53381

EUVD

EUVD-2026-45503

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.0.14 (exc)
linux	linux_kernel	From 7.1 (inc) to 7.1.2 (exc)
linux	linux_kernel	From 5.10.246 (inc) to 5.10.260 (exc)
linux	linux_kernel	From 5.15.196 (inc) to 5.15.211 (exc)
linux	linux_kernel	From 6.1.158 (inc) to 6.1.177 (exc)
linux	linux_kernel	From 6.12.54 (inc) to 6.12.95 (exc)
linux	linux_kernel	From 6.17.4 (inc) to 6.18.37 (exc)
linux	linux_kernel	From 6.6.115 (inc) to 6.6.144 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free (UAF) issue in the virtiofs filesystem. When a submount is unmounted, the fuse_release_end() function calls iput() which can cause a kernel crash if the super block has already been destroyed. The problem occurs because the wait counter for super block shutdown is per connection, not per super block, allowing the issue to persist for non-last submount instances. The fix reverts to using synchronous release requests for auto_submounts, which is specific to virtiofs.

Detection Guidance

This vulnerability is specific to the Linux kernel's virtiofs subsystem and may not have direct network detection methods. Check kernel logs for fuse-related errors or crashes using commands like dmesg | grep -i fuse or journalctl -k | grep -i fuse.

Impact Analysis

This vulnerability could lead to system crashes or instability if exploited. Users running systems with virtiofs, particularly those using virtualization with shared filesystems, may experience kernel oopses or unexpected shutdowns. It does not directly expose data but could disrupt services relying on virtiofs.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Linux kernel issue related to a use-after-free (UAF) in the virtiofs subsystem. Compliance impacts would depend on system configuration and usage rather than the vulnerability itself.

Mitigation Strategies

Apply the latest Linux kernel updates to patch this issue. If using virtiofs, consider disabling auto_submounts if not required. Monitor kernel logs for fuse-related errors after applying updates.

Hi! I’m here to help you understand CVE-2026-53381. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70