Skip to main content

Linux Kernel CVE-2026-53381

| EUVDEUVD-2026-45503 HIGH
Use After Free (CWE-416)
2026-07-19 Linux GHSA-525m-f6h4-6w58
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local, low-privilege trigger (AV:L/PR:L); AC:H because exploitation is a race against per-connection shutdown requiring multiple submounts; kernel UAF yields high C/I/A.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 18:02 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 11:59 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 11:59 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

virtiofs: fix UAF on submount umount

iput() called from fuse_release_end() can Oops if the super block has already been destroyed. Normally this is prevented by waiting for num_waiting to go down to zero before commencing with super block shutdown.

This only works, however, for the last submount instance, as the wait counter is per connection, not per superblock.

Revert to using synchronous release requests for the auto_submounts case, which is virtiofs only at this time.

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's virtiofs (virtio-fs) driver arises from a use-after-free triggered when an auto-submount is unmounted, where iput() called from fuse_release_end() can dereference an already-destroyed superblock. Because the FUSE num_waiting counter is per-connection rather than per-superblock, the shutdown wait only protects the last submount instance, leaving earlier submounts exposed. The fix reverts virtiofs auto_submounts to synchronous release requests; no public exploit is identified at time of analysis and EPSS risk is low (0.19%).

Technical ContextAI

The affected component is FUSE (Filesystem in Userspace) as used by virtiofs, the shared-filesystem transport for KVM/QEMU guests that lets a guest mount a directory exported by the host via a virtio device. Virtiofs supports 'auto submounts,' where a single virtiofs mount can automatically expose nested submounts, each backed by its own VFS superblock but sharing one FUSE connection. On unmount, the kernel normally waits for the connection's num_waiting reference counter to reach zero before tearing down the superblock; because that counter is scoped to the connection and not the individual superblock, a non-last submount's superblock can be freed while an in-flight release request still holds references. When fuse_release_end() later calls iput() on an inode belonging to that freed superblock, the dangling pointer is dereferenced - a classic use-after-free (CWE-416). The CPE data identifies the product broadly as cpe:2.3:a:linux:linux, i.e. the mainline Linux kernel, and the flaw is specific to the virtiofs path since auto_submounts is virtiofs-only at present.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 7.0.14, or 7.1.2 (fix also in mainline 6.18 / 7.2-rc1) - matching your kernel series; the corrective commits are published at git.kernel.org/stable (for example https://git.kernel.org/stable/c/06b41351779e9289e8785694ade9042ae85e41ea and https://git.kernel.org/stable/c/97c4691653d145dcc699eca5d3aba3219a520f1f), and details are at https://nvd.nist.gov/vuln/detail/CVE-2026-53381. Where immediate patching is not possible, the practical compensating control is to avoid virtiofs auto-submount configurations: do not export host directory trees that cross mount boundaries (submounts) over virtiofs, or disable the submounts behavior in the virtiofs/QEMU shared-directory setup so nested submounts are not auto-created - the trade-off is that guests lose transparent access to nested mount points on the shared directory. Since exploitation is local to hosts/guests using virtiofs, restricting which guests and users can mount/unmount virtiofs shares also reduces exposure until the patch is applied.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53381 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy