Skip to main content

Linux Kernel CVE-2026-53272

| EUVDEUVD-2026-39223 HIGH
Use After Free (CWE-416)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-pc3h-m9mc-v77g
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local access to EROFS-enabled host
  2. Delivery
    Mount and read crafted EROFS image
  3. Exploit
    Trigger async decompression on I/O completion
  4. Execution
    Race concurrent unmount freeing sbi
  5. Persist
    kworker dereferences freed sbi->sync_decompress
  6. Impact
    Kernel memory corruption / potential privilege escalation

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires local access with the ability to drive the EROFS compressed-read path and then unmount that filesystem, so the attacker must be able to mount/read/unmount an EROFS volume - plausible via removable media, loopback images, or container mount namespaces that expose EROFS. The core prerequisite is winning the race between z_erofs_endio() queuing z_erofs_decompressqueue_work() and the unmount workflow calling kfree(sbi), meaning the attacker must trigger asynchronous (deferred) decompression and time the unmount to overlap the kworker's access to sbi->sync_decompress. Limiting factors: it is not remotely reachable (AV:L), it requires privileges to mount/unmount (PR:L), it needs no user interaction, and it depends on precise timing of a narrow window plus a vulnerable EROFS-enabled kernel - the low EPSS (0.16%) reflects that this race is hard to win reliably despite the AC:L rating.
Impact

The signals are internally consistent and point to a genuine but not urgent memory-corruption bug. The official CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) reflects local, low-privilege exploitation with full impact, but the underlying defect is a narrow unmount race whose real-world complexity is higher than AC:L implies - winning a tight timing window between async decompression completion and kfree(sbi) is non-trivial, which the low EPSS (0.16%, 6th percentile) corroborates. There is no KEV listing and no POC signal, so this warrants normal patch cadence rather than emergency response. No SSVC decision data was supplied. Note the 'Information Disclosure' tag alongside the UAF: a use-after-free can leak freed kernel memory, but the description only demonstrates the crash/corruption path, so an info-leak primitive is plausible yet unconfirmed. The one tension to flag: AC:L in the vector versus a race-condition root cause that realistically needs precise timing - treat exploitability as harder than the raw score suggests.
Exploit ScenarioDerived

A local attacker able to mount and unmount an EROFS filesystem (for example via a crafted compressed image on removable media or inside a permissive container) issues reads that queue asynchronous decompression work, then races an unmount to free the superblock while the kworker still accesses sbi->sync_decompress. Hitting the window frees and reuses kernel memory, causing corruption that can crash the system or, with heap grooming, potentially escalate privileges. No public exploit is identified at time of analysis, and the tight timing makes reliable exploitation difficult.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 08, 2026

Use-after-free in the Linux kernel's EROFS filesystem lets a local attacker who can trigger a decompression I/O race during unmount corrupt kernel memory. When z_erofs_decompress_kickoff() queues asynchronous decompression work, a concurrent unmount can free the superblock info (sbi) before the kworker accesses sbi->sync_decompress, producing a CWE-416 use-after-free with high confidentiality, integrity and availability impact (CVSS 7.8). EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis; the flaw is not on CISA KEV.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux kernel - 6.12.94, 6.18.36, 7.0.13, or 7.1 (or later) - or apply the corresponding stable commits (00bf6868, 1aee05e8, 86ab00cf, 95caf60d) from https://git.kernel.org/stable/ that correct the sbi lifetime handling around z_erofs_decompress_kickoff(). For most environments this means taking your distribution's next kernel update and rebooting. Where immediate patching is not possible, reduce exposure by limiting who can mount and unmount EROFS filesystems: avoid auto-mounting untrusted EROFS images from removable media or unprivileged containers, and restrict mount privileges, since triggering the race requires exercising the EROFS decompression path followed by an unmount. These are hardening measures only and do not close the race - the reliable fix is the kernel upgrade. Track distributor advisories via the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-53272 .

Affected VersionsENISA

Linux 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 <1aee05e814d292064bf5fa15733741040cdc48ba
Linux 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 <86ab00cf81d44b675bb23db62b88fd76c8ac8cea
Linux 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 <95caf60da33d87ed26c28993620f0d92487b0296
Linux patch: 6.12.94
Linux patch: 0
Linux 5.17
Linux 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 <00bf6868df65fa95b3854996246d15759fdc7070
Linux patch: 7.1
Linux patch: 6.18.36
Linux patch: 7.0.13

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

EROFS (Enhanced Read-Only File System) is a compressed, read-only Linux filesystem widely deployed for Android system images, container/OCI image layers, and embedded/appliance firmware. The bug lives in the compressed-data read path: on I/O completion, z_erofs_endio() calls z_erofs_decompress_kickoff() to schedule z_erofs_decompressqueue_work() on a kworker. Because the folios are unlocked before the deferred work reads sbi->sync_decompress, the unmount path (cleanup_mnt -> erofs_kill_sb -> erofs_sb_free -> kfree(sbi)) can free the per-superblock structure first, so the kworker then dereferences freed memory. This is a classic object-lifetime/refcount race (CWE-416 use-after-free) between an asynchronous work queue and superblock teardown, confirmed by the CPE data to affect only the Linux kernel (cpe:2.3:o:linux:linux_kernel).

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local low-privilege attacker needs mount/unmount ability (PR:L) and must win a tight teardown race (AC:H); the UAF yields full C/I/A impact within the kernel (S:U).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 08, 2026 - 04:07 NVD
7.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 nvd
HIGH 7.8
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix use-after-free on sbi->sync_decompress

z_erofs_decompress_kickoff() can race with filesystem unmount, causing a use-after-free on sbi->sync_decompress.

When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff() to queue z_erofs_decompressqueue_work() asynchronously. Then, after all folios are unlocked, unmount workflow can proceed and sbi will be freed before accessing to sbi->sync_decompress.

Thread (unmount) I/O completion kworker queue_work z_erofs_decompressqueue_work (all folios are unlocked) cleanup_mnt .. erofs_kill_sb erofs_sb_free kfree(sbi) access sbi->sync_decompress // UAF!!

Executive ViewAI

Why It Matters

A use-after-free vulnerability in the Linux kernel's EROFS filesystem (CVE-2026-53272) could allow local attackers to corrupt kernel memory through a race condition during filesystem unmount, potentially leading to system crashes or privilege escalation. While practical attack risk remains low due to the requirement for local system access and complex timing conditions, the underlying severity (CVSS 7.8) requires prompt patching across all affected systems. Organizations running Linux systems with EROFS should prioritize kernel updates.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel; EROFS ships in Android and container/embedded deployments worldwide
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53272 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/373828 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22742/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22769/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://git.kernel.org/stable/c/00bf6868df65fa95b3854996246d15759fdc7070 REF https://git.kernel.org/stable/c/1aee05e814d292064bf5fa15733741040cdc48ba REF https://git.kernel.org/stable/c/5627e57f1da68ff0146896eb3d2eed25e62adc44 REF https://git.kernel.org/stable/c/59db5d8bcc65e04d8598afd81ec3a18edb407470 REF https://git.kernel.org/stable/c/86ab00cf81d44b675bb23db62b88fd76c8ac8cea REF https://git.kernel.org/stable/c/95caf60da33d87ed26c28993620f0d92487b0296

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy