fuse: re-lock request before replacing page cache folio

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-53388
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-19 12:16:49 UTC
Updated2026-07-20 15:16:41 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end the request and free the fuse_io_args (eg fuse_readpages_end()) while the subsequent copy chain logic after fuse_try_move_folio() accesses the fuse_io_args, leading to use-after-free issues. Fix this by calling lock_request() before replace_page_cache_folio(). This ensures the request is locked on the success path which will prevent the fuse_io_args from being freed while the later copying logic runs, and also ensures that the ap->folios[i]->mapping is never null since ap->folios[i] will always point to the newfolio after replace_page_cache_folio().

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001770000 probability, percentile 0.074200000 (date 2026-07-20)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected ce534fb052928ce556639d7ecf01cbf4e01321e1 7c18691e0cfda29672f79bafde8abdb7710674f6 git Not specified
CNA Linux Linux affected ce534fb052928ce556639d7ecf01cbf4e01321e1 5927b43a4f8d89e86930f524bf63e9c7e66f61b4 git Not specified
CNA Linux Linux affected ce534fb052928ce556639d7ecf01cbf4e01321e1 030fe3e9d8abdee303dd7e9e42f45082d382a407 git Not specified
CNA Linux Linux affected ce534fb052928ce556639d7ecf01cbf4e01321e1 46473ddccdc5065033e397d6e62c280dbcd3d9c2 git Not specified
CNA Linux Linux affected ce534fb052928ce556639d7ecf01cbf4e01321e1 af2892249d982a1c036ca456cc135374e68b6677 git Not specified
CNA Linux Linux affected ce534fb052928ce556639d7ecf01cbf4e01321e1 0223f452532d9cd8a5e87c45de828fd93c99bd25 git Not specified
CNA Linux Linux affected ce534fb052928ce556639d7ecf01cbf4e01321e1 e28db6ac4792d065ab32565fd9f0a2361c3d4666 git Not specified
CNA Linux Linux affected ce534fb052928ce556639d7ecf01cbf4e01321e1 a078484921052d0badd827fcc2770b5cfc1d4120 git Not specified
CNA Linux Linux affected 2.6.35 Not specified
CNA Linux Linux unaffected 2.6.35 semver Not specified
CNA Linux Linux unaffected 5.15.211 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.177 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.144 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.95 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.37 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.14 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1.2 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/5927b43a4f8d89e86930f524bf63e9c7e66f61b4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/0223f452532d9cd8a5e87c45de828fd93c99bd25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/46473ddccdc5065033e397d6e62c280dbcd3d9c2 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/030fe3e9d8abdee303dd7e9e42f45082d382a407 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e28db6ac4792d065ab32565fd9f0a2361c3d4666 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/af2892249d982a1c036ca456cc135374e68b6677 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a078484921052d0badd827fcc2770b5cfc1d4120 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/7c18691e0cfda29672f79bafde8abdb7710674f6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report