Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-53129

fs/mbcache: cancel shrink work before destroying the cache

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: fs/mbcache: cancel shrink work before destroying the cache mb_cache_destroy() calls shrinker_free() and then frees all cache entries and the cache itself, but it does not cancel the pending c_shrink_work work item first. If mb_cache_entry_create() schedules c_shrink_work via schedule_work() and the work item is still pending or running when mb_cache_destroy() runs, mb_cache_shrink_worker() will access the cache after its memory has been freed, causing a use-after-free. This is only reachable by a privileged user (root or CAP_SYS_ADMIN) who can trigger the last put of a mounted ext2/ext4/ocfs2 filesystem. Cancel the work item with cancel_work_sync() before calling shrinker_free(), ensuring the worker has finished and will not be rescheduled before the cache is torn down.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • c2f3140fe2eceb3a6c1615b2648b9471544881c6 to < cbdd6f0fb19a0ce8a013acd80ac87a62f57fa20daffected
  • c2f3140fe2eceb3a6c1615b2648b9471544881c6 to < a88d39a74a208e197c03bffaa2df34de732af19faffected
  • c2f3140fe2eceb3a6c1615b2648b9471544881c6 to < 0e4eff315d799f5842b95872199b0f0fb8ef5f51affected
  • c2f3140fe2eceb3a6c1615b2648b9471544881c6 to < b25fd3523bef88fb7ffd4c5b63bbe9c08f73bb4caffected
  • c2f3140fe2eceb3a6c1615b2648b9471544881c6 to < d227786ab1119669df4dc333a61510c52047cce4affected

Linux Linux

Default version status: affected

  • 4.6affected
  • 0 to < 4.6unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.91 to ≤ 6.12.*unaffected
  • 6.18.33 to ≤ 6.18.*unaffected
  • 7.0.10 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References