Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-53381

virtiofs: fix UAF on submount umount

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput() called from fuse_release_end() can Oops if the super block has already been destroyed. Normally this is prevented by waiting for num_waiting to go down to zero before commencing with super block shutdown. This only works, however, for the last submount instance, as the wait counter is per connection, not per superblock. Revert to using synchronous release requests for the auto_submounts case, which is virtiofs only at this time.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 548e1f2bac1d4df91a6138f26bb4ab00323fd948 to < 607a1d4c42f649e6197567c0448fd9ebb316cd42affected
  • cfd1aa3e2b71f3327cb373c45a897c9028c62b35 to < 1cc0e3a0c6499aaaa2f21a4fcbba388486afb25eaffected
  • 83b375c6efef69b1066ad2d79601221e7892745a to < 0b809199ff87c44487e516a725dd4be2185712ceaffected
  • bfd17b6138df0122a95989457d8e18ce0b86165e to < 2181a09ba980f142650fb053666350ead4471cfeaffected
  • b26923512dbe57ae4917bafd31396d22a9d1691a to < 97c4691653d145dcc699eca5d3aba3219a520f1faffected
  • 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 to < 2abfd3ffbd9452f72535d96ff3982b3ab1f8f2f9affected
  • 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 to < 39a2b95e008665c14f84e50ed411d898df7cd11baffected
  • 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 to < e09412a714bcd49375198427bb4aa005037a9d6faffected
  • 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 to < 06b41351779e9289e8785694ade9042ae85e41eaaffected
  • f19a1390af448d9e193c08e28ea5f727bf3c3049affected
  • 5.10.246 to < 5.10.260affected
  • 5.15.196 to < 5.15.211affected
  • 6.1.158 to < 6.1.177affected
  • 6.6.115 to < 6.6.144affected
  • 6.12.54 to < 6.12.95affected
  • 6.17.4 to < 6.18affected

Linux Linux

Default version status: affected

  • 6.18affected
  • 0 to < 6.18unaffected
  • 5.10.260 to ≤ 5.10.*unaffected
  • 5.15.211 to ≤ 5.15.*unaffected
  • 6.1.177 to ≤ 6.1.*unaffected
  • 6.6.144 to ≤ 6.6.*unaffected
  • 6.12.95 to ≤ 6.12.*unaffected
  • 6.18.37 to ≤ 6.18.*unaffected
  • 7.0.14 to ≤ 7.0.*unaffected
  • 7.1.2 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References