Skip to main content

Linux Kernel CVE-2026-53388

| EUVDEUVD-2026-45510 HIGH
Use After Free (CWE-416)
2026-07-19 Linux GHSA-45w6-5frg-3vfq
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local low-privileged access via FUSE (AV:L/PR:L); AC:H because success depends on winning a narrow abort-vs-copy race; kernel UAF yields high memory-disclosure, corruption and crash impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 18:06 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 11:59 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 11:59 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fuse: re-lock request before replacing page cache folio

fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end the request and free the fuse_io_args (eg fuse_readpages_end()) while the subsequent copy chain logic after fuse_try_move_folio() accesses the fuse_io_args, leading to use-after-free issues.

Fix this by calling lock_request() before replace_page_cache_folio(). This ensures the request is locked on the success path which will prevent the fuse_io_args from being freed while the later copying logic runs, and also ensures that the ap->folios[i]->mapping is never null since ap->folios[i] will always point to the newfolio after replace_page_cache_folio().

AnalysisAI

Use-after-free in the Linux kernel's FUSE (Filesystem in Userspace) subsystem allows a local low-privileged attacker to access or corrupt freed kernel memory by racing a request abort against the page-cache folio replacement path in fuse_try_move_folio(). Because the function unlocks the request on entry but fails to re-lock it on the success path, fuse_chan_abort() can end the request and free the fuse_io_args (e.g., via fuse_readpages_end()) while the subsequent copy-chain logic still dereferences that structure. Rated CVSS 7.8 (local, high C/I/A impact); no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile).

Technical ContextAI

FUSE lets userspace processes implement filesystems that the kernel routes I/O through, making the userspace daemon an untrusted participant in kernel data flows. The affected routine, fuse_try_move_folio(), optimizes read responses by moving (rather than copying) a folio from the FUSE request into the page cache via replace_page_cache_folio(). The root cause is a locking-lifecycle defect (a use-after-free, CWE-416 class, though CWE is marked N/A in the feed): the request lock is dropped on entry and not reacquired before the folio swap, so a concurrent channel abort can free the fuse_io_args argument structure that the post-move copy logic still reads. The fix reinstates lock_request() before replace_page_cache_folio(), which both keeps the request alive during the trailing copy and guarantees ap->folios[i]->mapping is non-NULL because ap->folios[i] points at the newfolio after replacement. CPE data identifies the affected component generically as cpe:2.3:a:linux:linux, i.e., the mainline kernel's FUSE driver rather than a distro-specific package.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.37, 7.0.14 or 7.1.2 (mainline fixed before 7.2-rc1) - matching your branch, or apply your distribution's corresponding kernel security update and reboot. The upstream fix is the commit set on git.kernel.org (e.g., https://git.kernel.org/stable/c/af2892249d982a1c036ca456cc135374e68b6677); track your distro advisory for the packaged build. If patching must be deferred, the most effective compensating control is to restrict who can mount FUSE filesystems: ensure user_allow_other/unprivileged FUSE is not exposed to untrusted users and confirm sysctl/Kconfig gating (e.g., avoid CONFIG-enabled unprivileged FUSE, or set fusermount to restrict non-root mounts), which reduces the local attack surface at the cost of breaking user-mounted filesystems and some sandbox/container tooling that relies on unprivileged FUSE. Where FUSE is not needed at all, unloading or blacklisting the fuse module removes the exposure entirely, with the trade-off of disabling any application depending on it.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-53388 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy