CVE-2026-53129
published 2026-06-24CVE-2026-53129: In the Linux kernel, the following vulnerability has been resolved: fs/mbcache: cancel shrink work before destroying the cache mb_cache_destroy() calls…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.12%
1.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
fs/mbcache: cancel shrink work before destroying the cache
mb_cache_destroy() calls shrinker_free() and then frees all cache
entries and the cache itself, but it does not cancel the pending
c_shrink_work work item first.
If mb_cache_entry_create() schedules c_shrink_work via schedule_work()
and the work item is still pending or running when mb_cache_destroy()
runs, mb_cache_shrink_worker() will access the cache after its memory
has been freed, causing a use-after-free.
This is only reachable by a privileged user (root or CAP_SYS_ADMIN)
who can trigger the last put of a mounted ext2/ext4/ocfs2 filesystem.
Cancel the work item with cancel_work_sync() before calling
shrinker_free(), ensuring the worker has finished and will not be
rescheduled before the cache is torn down.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= c2f3140fe2eceb3a6c1615b2648b9471544881c6 < a88d39a74a208e197c03bffaa2df34de732af19f | a88d39a74a208e197c03bffaa2df34de732af19f |
| linux | linux | >= c2f3140fe2eceb3a6c1615b2648b9471544881c6 < 0e4eff315d799f5842b95872199b0f0fb8ef5f51 | 0e4eff315d799f5842b95872199b0f0fb8ef5f51 |
| linux | linux | >= c2f3140fe2eceb3a6c1615b2648b9471544881c6 < b25fd3523bef88fb7ffd4c5b63bbe9c08f73bb4c | b25fd3523bef88fb7ffd4c5b63bbe9c08f73bb4c |
| linux | linux | >= c2f3140fe2eceb3a6c1615b2648b9471544881c6 < d227786ab1119669df4dc333a61510c52047cce4 | d227786ab1119669df4dc333a61510c52047cce4 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 4.6 < 6.12.91 | 6.12.91 |
| linux | linux_kernel | >= 6.13 < 6.18.33 | 6.18.33 |
| linux | linux_kernel | >= 6.19 < 7.0.10 | 7.0.10 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In the Linux kernel, the following vulnerability has been resolved: fs/mbcache: cancel shrink work before destroying the cache mb_cache_destroy() calls shrinker_free() and then frees all cache entri
ghsa_unreviewed·2026-06-24
CVE-2026-53129 In the Linux kernel, the following vulnerability has been resolved: fs/mbcache: cancel shrink work before destroying the cache mb_cache_destroy() calls shrinker_free() and then frees all cache entri
In the Linux kernel, the following vulnerability has been resolved:
fs/mbcache: cancel shrink work before destroying the cache
mb_cache_destroy() calls shrinker_free() and then frees all cache
entries and the cache itself, but it does not cancel the pending
c_shrink_work work item first.
If mb_cache_entry_create() schedules c_shrink_work via schedule_work()
and the work item is still pending or running when mb_cache_destroy()
runs, mb_cache_shrink_worker() will access the cache after its memory
has been freed, causing a use-after-free.
This is only reachable by a privileged user (root or CAP_SYS_ADMIN)
who can trigger the last put of a mounted ext2/ext4/ocfs2 filesystem.
Cancel the work item with cancel_work_sync() before calling
shrinker_free(), ensuring the worker has finished and w
Red Hat
kernel: fs/mbcache: cancel shrink work before destroying the cache
vendor_redhat·2026-06-24·CVSS 5.5
CVE-2026-53129 [MEDIUM] kernel: fs/mbcache: cancel shrink work before destroying the cache
kernel: fs/mbcache: cancel shrink work before destroying the cache
No description is available for this CVE.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Fix deferred
Package: kernel-rt (Red Hat Enterprise Linux 8) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 9) - Fix deferred
Package: kernel-rt (Red Hat Enterprise Linux 9) - Fix deferred
No detection rules found.
No public exploits indexed.
2026-06-24
Published