Skip to main content

Linux Kernel CVE-2026-53129

| EUVDEUVD-2026-38997 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-76p3-3v32-9xxh
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Obtain root/CAP_SYS_ADMIN locally
  2. Delivery
    Populate mbcache entries on ext4 mount
  3. Exploit
    Keep c_shrink_work scheduled
  4. Install
    Trigger final filesystem unmount
  5. C2
    Race worker against mb_cache_destroy
  6. Execute
    Use-after-free on freed cache
  7. Impact
    Kernel corruption or crash

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires an already-privileged local user (root or CAP_SYS_ADMIN) who can trigger the last put/unmount of a mounted ext2, ext4, or ocfs2 filesystem while c_shrink_work is pending or running - the worker must have been scheduled by prior mb_cache_entry_create activity and still be active during mb_cache_destroy(). Limiting factors: it is not remotely reachable (AV:L), it grants no privilege the attacker lacks (already needs CAP_SYS_ADMIN), it depends on winning a workqueue timing race, and it only applies to systems mounting mbcache-using filesystems (ext2/ext4/ocfs2). Note that the CVSS PR:L understates the description's explicit root/CAP_SYS_ADMIN requirement - treat the privilege prerequisite as high.
Impact

Signals are consistent and point to a real-but-low-urgency hardening fix rather than an actively exploited threat. The CVSS 3.1 base score is 7.8 (High) with a fully local vector (AV:L/AC:L/PR:L/UI:N) and high C/I/A impact, but the description explicitly narrows reachability to a privileged user (root or CAP_SYS_ADMIN) who can trigger the last put of a mounted ext2/ext4/ocfs2 filesystem - which is a stronger prerequisite than the PR:L the vector claims. This PR:L-versus-'root/CAP_SYS_ADMIN required' discrepancy should be verified with the vendor; my independent assessment uses PR:H, lowering the effective score to roughly 6.7. EPSS (0.16%, 5th percentile) is low, there is no KEV listing, and no public exploit exists, so this is not a widespread-exploitation priority. An attacker who already holds root gains little new capability, so real-world risk is dominated by reliability/DoS and defense-in-depth value rather than privilege escalation from an unprivileged position.
Exploit ScenarioDerived

A local attacker who has already obtained root or CAP_SYS_ADMIN (for example inside a privileged container or via a mount-capable service) repeatedly creates mbcache entries on an ext4/ext2/ocfs2 mount to keep c_shrink_work scheduled, then triggers the final unmount so mb_cache_destroy() races the still-running shrink worker. Winning the race yields a use-after-free on the freed cache object that can crash the kernel or be groomed toward controlled memory corruption. No public exploit is known, and the tight timing window plus required privilege make reliable exploitation difficult.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 06, 2026

Local privilege-dependent use-after-free in the Linux kernel's fs/mbcache subsystem allows a privileged user (root or CAP_SYS_ADMIN) to trigger memory corruption when unmounting an ext2, ext4, or ocfs2 filesystem. mb_cache_destroy() frees the cache without cancelling the pending c_shrink_work item, so a still-running mb_cache_shrink_worker() accesses freed memory (CWE-416), potentially leading to kernel code execution or crash. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and it is not on CISA KEV.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.12.91, 6.18.33, 7.0.10, or 7.1 (or your distribution's backported equivalent) - which adds cancel_work_sync() before shrinker_free() in mb_cache_destroy(). The fix commits are at https://git.kernel.org/stable/c/a88d39a74a208e197c03bffaa2df34de732af19f and the sibling stable references above; distribution advisories track https://nvd.nist.gov/vuln/detail/CVE-2026-53129. Because exploitation requires root or CAP_SYS_ADMIN to perform the final unmount, the most effective compensating control until patching is to restrict who can mount and unmount filesystems and who holds CAP_SYS_ADMIN - avoid granting mount capability to containers or service accounts, and disable user-controlled or automatic mounting of ext2/ext4/ocfs2 volumes; the trade-off is reduced flexibility for dynamic storage and container workloads that legitimately mount filesystems.

Affected VersionsENISA

Linux patch: 7.1
Linux c2f3140fe2eceb3a6c1615b2648b9471544881c6 <b25fd3523bef88fb7ffd4c5b63bbe9c08f73bb4c
Linux patch: 6.18.33
Linux c2f3140fe2eceb3a6c1615b2648b9471544881c6 <0e4eff315d799f5842b95872199b0f0fb8ef5f51
Linux patch: 7.0.10
Linux c2f3140fe2eceb3a6c1615b2648b9471544881c6 <a88d39a74a208e197c03bffaa2df34de732af19f
Linux 4.6
Linux patch: 6.12.91
Linux patch: 0
Linux c2f3140fe2eceb3a6c1615b2648b9471544881c6 <d227786ab1119669df4dc333a61510c52047cce4

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The mbcache (fs/mbcache.c) is a generic in-kernel metadata block cache used by ext2, ext4, and ocfs2 to deduplicate extended-attribute (xattr) blocks. It uses a deferred workqueue item, c_shrink_work, scheduled via schedule_work() from mb_cache_entry_create() to shrink the cache under memory pressure. The root cause is a use-after-free (CWE-416): mb_cache_destroy() calls shrinker_free() and frees all entries and the cache structure itself, but never calls cancel_work_sync() to flush the pending or running shrink worker. If the worker is still queued or executing during teardown, mb_cache_shrink_worker() dereferences the already-freed cache object. The affected CPE is cpe:2.3:a:linux:linux, i.e. the mainline/stable Linux kernel.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.7 MEDIUM

Description requires root/CAP_SYS_ADMIN so PR:H not PR:L; local unmount trigger gives AV:L, and a kernel UAF supports high C/I/A.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 06, 2026 - 15:37 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

fs/mbcache: cancel shrink work before destroying the cache

mb_cache_destroy() calls shrinker_free() and then frees all cache entries and the cache itself, but it does not cancel the pending c_shrink_work work item first.

If mb_cache_entry_create() schedules c_shrink_work via schedule_work() and the work item is still pending or running when mb_cache_destroy() runs, mb_cache_shrink_worker() will access the cache after its memory has been freed, causing a use-after-free.

This is only reachable by a privileged user (root or CAP_SYS_ADMIN) who can trigger the last put of a mounted ext2/ext4/ocfs2 filesystem.

Cancel the work item with cancel_work_sync() before calling shrinker_free(), ensuring the worker has finished and will not be rescheduled before the cache is torn down.

Executive ViewAI

Why It Matters

CVE-2026-53129 affects Linux servers running ext2, ext4, or ocfs2 filesystems and can be triggered by privileged users to corrupt kernel memory, risking service unavailability or unauthorized code execution. Given the availability of patches and absence of current public exploits, this vulnerability presents a manageable risk that requires timely deployment to eliminate local attack vectors and maintain service stability.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Ubiquitous
Linux kernel with ext4/ext2 mbcache in nearly all Linux deployments
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53129 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373399 REF https://git.kernel.org/stable/c/0e4eff315d799f5842b95872199b0f0fb8ef5f51 REF https://git.kernel.org/stable/c/40148c615687c1692712e50a6de53d62dfbfc20f REF https://git.kernel.org/stable/c/a88d39a74a208e197c03bffaa2df34de732af19f REF https://git.kernel.org/stable/c/b25fd3523bef88fb7ffd4c5b63bbe9c08f73bb4c REF https://git.kernel.org/stable/c/cbdd6f0fb19a0ce8a013acd80ac87a62f57fa20d REF https://git.kernel.org/stable/c/d227786ab1119669df4dc333a61510c52047cce4

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy