CVE-2026-53388

Awaiting Analysis Awaiting Analysis - Queue

FUSE Request Use-After-Free in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end the request and free the fuse_io_args (eg fuse_readpages_end()) while the subsequent copy chain logic after fuse_try_move_folio() accesses the fuse_io_args, leading to use-after-free issues. Fix this by calling lock_request() before replace_page_cache_folio(). This ensures the request is locked on the success path which will prevent the fuse_io_args from being freed while the later copying logic runs, and also ensures that the ap->folios[i]->mapping is never null since ap->folios[i] will always point to the newfolio after replace_page_cache_folio().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-07-29

Generated

2026-08-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-08

NVD

CVE-2026-53388

EUVD

EUVD-2026-45510

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.16 (inc) to 6.1.177 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.144 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.95 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.37 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.14 (exc)
linux	linux_kernel	From 7.1 (inc) to 7.1.2 (exc)
linux	linux_kernel	From 2.6.35 (inc) to 5.15.211 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the FUSE (Filesystem in Userspace) subsystem. The issue occurs when fuse_try_move_folio() unlocks a request but fails to re-lock it on the success path. This allows fuse_chan_abort() to prematurely end the request and free memory while subsequent operations still try to access it, leading to a use-after-free condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's FUSE (Filesystem in Userspace) implementation. Detection requires checking the kernel version and FUSE module behavior. Use commands like 'uname -a' to check the kernel version and 'lsmod | grep fuse' to verify if FUSE is loaded. If your kernel version is vulnerable, you may need to update it.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or potential privilege escalation if exploited. An attacker with local access might trigger the use-after-free to execute arbitrary code or cause denial-of-service conditions on affected systems.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's FUSE (Filesystem in Userspace) component. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than kernel-level memory management flaws.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version provided by your distribution. This vulnerability is fixed in newer kernels, so applying security patches is the primary mitigation. If updating is not immediately possible, consider disabling FUSE if it is not required for your system.

Hi! I’m here to help you understand CVE-2026-53388. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70