Skip to main content

Linux Kernel EUVDEUVD-2026-38997

| CVE-2026-53129 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-76p3-3v32-9xxh
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.7 MEDIUM

Description requires root/CAP_SYS_ADMIN so PR:H not PR:L; local unmount trigger gives AV:L, and a kernel UAF supports high C/I/A.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 06, 2026 - 15:38 vuln.today
CVSS changed
Jul 06, 2026 - 15:37 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

fs/mbcache: cancel shrink work before destroying the cache

mb_cache_destroy() calls shrinker_free() and then frees all cache entries and the cache itself, but it does not cancel the pending c_shrink_work work item first.

If mb_cache_entry_create() schedules c_shrink_work via schedule_work() and the work item is still pending or running when mb_cache_destroy() runs, mb_cache_shrink_worker() will access the cache after its memory has been freed, causing a use-after-free.

This is only reachable by a privileged user (root or CAP_SYS_ADMIN) who can trigger the last put of a mounted ext2/ext4/ocfs2 filesystem.

Cancel the work item with cancel_work_sync() before calling shrinker_free(), ensuring the worker has finished and will not be rescheduled before the cache is torn down.

AnalysisAI

Local privilege-dependent use-after-free in the Linux kernel's fs/mbcache subsystem allows a privileged user (root or CAP_SYS_ADMIN) to trigger memory corruption when unmounting an ext2, ext4, or ocfs2 filesystem. mb_cache_destroy() frees the cache without cancelling the pending c_shrink_work item, so a still-running mb_cache_shrink_worker() accesses freed memory (CWE-416), potentially leading to kernel code execution or crash. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and it is not on CISA KEV.

Technical ContextAI

The mbcache (fs/mbcache.c) is a generic in-kernel metadata block cache used by ext2, ext4, and ocfs2 to deduplicate extended-attribute (xattr) blocks. It uses a deferred workqueue item, c_shrink_work, scheduled via schedule_work() from mb_cache_entry_create() to shrink the cache under memory pressure. The root cause is a use-after-free (CWE-416): mb_cache_destroy() calls shrinker_free() and frees all entries and the cache structure itself, but never calls cancel_work_sync() to flush the pending or running shrink worker. If the worker is still queued or executing during teardown, mb_cache_shrink_worker() dereferences the already-freed cache object. The affected CPE is cpe:2.3:a:linux:linux, i.e. the mainline/stable Linux kernel.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.12.91, 6.18.33, 7.0.10, or 7.1 (or your distribution's backported equivalent) - which adds cancel_work_sync() before shrinker_free() in mb_cache_destroy(). The fix commits are at https://git.kernel.org/stable/c/a88d39a74a208e197c03bffaa2df34de732af19f and the sibling stable references above; distribution advisories track https://nvd.nist.gov/vuln/detail/CVE-2026-53129. Because exploitation requires root or CAP_SYS_ADMIN to perform the final unmount, the most effective compensating control until patching is to restrict who can mount and unmount filesystems and who holds CAP_SYS_ADMIN - avoid granting mount capability to containers or service accounts, and disable user-controlled or automatic mounting of ext2/ext4/ocfs2 volumes; the trade-off is reduced flexibility for dynamic storage and container workloads that legitimately mount filesystems.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38997 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy