CVE-2026-53381
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput() called from fuse_release_end() can Oops if the super block has already been destroyed. Normally this is prevented by waiting for num_waiting to go down to zero before commencing with super block shutdown. This only works, however, for the last submount instance, as the wait counter is per connection, not per superblock. Revert to using synchronous release requests for the auto_submounts case, which is virtiofs only at this time.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-07-19 12:16:48.807000
Last modified
2026-10-19 20:19:17.280000
View original CVE JSON
{
"id": "CVE-2026-53381",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-07-19T12:16:48.807",
"lastModified": "2026-10-19T20:19:17.280",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtiofs: fix UAF on submount umount\n\niput() called from fuse_release_end() can Oops if the super block has\nalready been destroyed. Normally this is prevented by waiting for\nnum_waiting to go down to zero before commencing with super block shutdown.\n\nThis only works, however, for the last submount instance, as the wait\ncounter is per connection, not per superblock.\n\nRevert to using synchronous release requests for the auto_submounts case,\nwhich is virtiofs only at this time."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"fs/fuse/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "548e1f2bac1d4df91a6138f26bb4ab00323fd948",
"lessThan": "607a1d4c42f649e6197567c0448fd9ebb316cd42",
"versionType": "git",
"status": "affected"
},
{
"version": "cfd1aa3e2b71f3327cb373c45a897c9028c62b35",
"lessThan": "1cc0e3a0c6499aaaa2f21a4fcbba388486afb25e",
"versionType": "git",
"status": "affected"
},
{
"version": "83b375c6efef69b1066ad2d79601221e7892745a",
"lessThan": "0b809199ff87c44487e516a725dd4be2185712ce",
"versionType": "git",
"status": "affected"
},
{
"version": "bfd17b6138df0122a95989457d8e18ce0b86165e",
"lessThan": "2181a09ba980f142650fb053666350ead4471cfe",
"versionType": "git",
"status": "affected"
},
{
"version": "b26923512dbe57ae4917bafd31396d22a9d1691a",
"lessThan": "97c4691653d145dcc699eca5d3aba3219a520f1f",
"versionType": "git",
"status": "affected"
},
{
"version": "26e5c67deb2e1f42a951f022fdf5b9f7eb747b01",
"lessThan": "2abfd3ffbd9452f72535d96ff3982b3ab1f8f2f9",
"versionType": "git",
"status": "affected"
},
{
"version": "26e5c67deb2e1f42a951f022fdf5b9f7eb747b01",
"lessThan": "39a2b95e008665c14f84e50ed411d898df7cd11b",
"versionType": "git",
"status": "affected"
},
{
"version": "26e5c67deb2e1f42a951f022fdf5b9f7eb747b01",
"lessThan": "e09412a714bcd49375198427bb4aa005037a9d6f",
"versionType": "git",
"status": "affected"
},
{
"version": "26e5c67deb2e1f42a951f022fdf5b9f7eb747b01",
"lessThan": "06b41351779e9289e8785694ade9042ae85e41ea",
"versionType": "git",
"status": "affected"
},
{
"version": "f19a1390af448d9e193c08e28ea5f727bf3c3049",
"versionType": "git",
"status": "affected"
},
{
"version": "5.10.246",
"lessThan": "5.10.260",
"versionType": "semver",
"status": "affected"
},
{
"version": "5.15.196",
"lessThan": "5.15.211",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.1.158",
"lessThan": "6.1.177",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.6.115",
"lessThan": "6.6.144",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.12.54",
"lessThan": "6.12.95",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.17.4",
"lessThan": "6.18",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"fs/fuse/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.18",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.18",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.260",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.211",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.177",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.144",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.95",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.37",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.0.14",
"lessThanOrEqual": "7.0.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1.2",
"lessThanOrEqual": "7.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-16T15:29:49.943123Z",
"id": "CVE-2026-53381",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.246",
"versionEndExcluding": "5.10.260",
"matchCriteriaId": "DECE3E82-AA55-4F8C-BD24-873FEE847389"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.196",
"versionEndExcluding": "5.15.211",
"matchCriteriaId": "A5F70B02-7A9F-41FD-81F0-A3FF35A52360"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.158",
"versionEndExcluding": "6.1.177",
"matchCriteriaId": "53A7F2A5-D556-44C0-AE41-59697FC6DAF3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.115",
"versionEndExcluding": "6.6.144",
"matchCriteriaId": "6F934316-BF34-4E24-A2B0-B2D644912175"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12.54",
"versionEndExcluding": "6.12.95",
"matchCriteriaId": "A1A0CFEB-D5EE-4964-8EE5-AA5FABB15C17"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.4",
"versionEndExcluding": "6.18.37",
"matchCriteriaId": "D3F07DC9-6CD1-42C8-9C17-C0FF22E4D7C5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "7.0.14",
"matchCriteriaId": "6241DF06-E6F3-4B61-B5A2-A60F2AE5B982"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.1",
"versionEndExcluding": "7.1.2",
"matchCriteriaId": "C18FAA06-B61A-4036-A12D-F06F5135E64B"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/06b41351779e9289e8785694ade9042ae85e41ea",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/0b809199ff87c44487e516a725dd4be2185712ce",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/1cc0e3a0c6499aaaa2f21a4fcbba388486afb25e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/2181a09ba980f142650fb053666350ead4471cfe",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/2abfd3ffbd9452f72535d96ff3982b3ab1f8f2f9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/39a2b95e008665c14f84e50ed411d898df7cd11b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/607a1d4c42f649e6197567c0448fd9ebb316cd42",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/97c4691653d145dcc699eca5d3aba3219a520f1f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/e09412a714bcd49375198427bb4aa005037a9d6f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}