CVE-2026-53272
published 2026-06-25CVE-2026-53272: In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sbi->sync_decompress z_erofs_decompress_kickoff() can race…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
2.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix use-after-free on sbi->sync_decompress
z_erofs_decompress_kickoff() can race with filesystem unmount, causing
a use-after-free on sbi->sync_decompress.
When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff()
to queue z_erofs_decompressqueue_work() asynchronously. Then, after all
folios are unlocked, unmount workflow can proceed and sbi will be freed
before accessing to sbi->sync_decompress.
Thread (unmount) I/O completion kworker
queue_work
z_erofs_decompressqueue_work
(all folios are unlocked)
cleanup_mnt
..
erofs_kill_sb
erofs_sb_free
kfree(sbi)
access sbi->sync_decompress // UAF!!
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 < 86ab00cf81d44b675bb23db62b88fd76c8ac8cea | 86ab00cf81d44b675bb23db62b88fd76c8ac8cea |
| linux | linux | >= 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 < 00bf6868df65fa95b3854996246d15759fdc7070 | 00bf6868df65fa95b3854996246d15759fdc7070 |
| linux | linux | >= 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 < 95caf60da33d87ed26c28993620f0d92487b0296 | 95caf60da33d87ed26c28993620f0d92487b0296 |
| linux | linux | >= 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 < 1aee05e814d292064bf5fa15733741040cdc48ba | 1aee05e814d292064bf5fa15733741040cdc48ba |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.17 < 6.12.94 | 6.12.94 |
| linux | linux_kernel | >= 6.13 < 6.18.36 | 6.18.36 |
| linux | linux_kernel | >= 6.19 < 7.0.13 | 7.0.13 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: erofs: fix use-after-free on sbi->sync_decompress
vendor_redhat·2026-06-25·CVSS 5.5
CVE-2026-53272 [MEDIUM] kernel: erofs: fix use-after-free on sbi->sync_decompress
kernel: erofs: fix use-after-free on sbi->sync_decompress
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix use-after-free on sbi->sync_decompress
z_erofs_decompress_kickoff() can race with filesystem unmount, causing
a use-after-free on sbi->sync_decompress.
When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff()
to queue z_erofs_decompressqueue_work() asynchronously. Then, after all
folios are unlocked, unmount workflow can proceed and sbi will be freed
before accessing to sbi->sync_decompress.
Thread (unmount) I/O completion kworker
queue_work
z_erofs_decompressqueue_work
(all folios are unlocked)
cleanup_mnt
..
erofs_kill_sb
erofs_sb_free
kfree(sbi)
access sbi->sync_decompress // UAF!!
Package: kernel (Red Hat Enterprise Linux 10) - Fix def
VulDB
Linux Kernel up to 6.12.93/6.18.35/7.0.12 erofs z_erofs_decompress_kickoff sync_decompress use after free (EUVD-2026-39223 / Nessus ID 323583)
vuldb·2026-06-29
CVE-2026-53272 [CRITICAL] Linux Kernel up to 6.12.93/6.18.35/7.0.12 erofs z_erofs_decompress_kickoff sync_decompress use after free (EUVD-2026-39223 / Nessus ID 323583)
A vulnerability classified as critical has been found in Linux Kernel up to 6.12.93/6.18.35/7.0.12. This vulnerability affects the function z_erofs_decompress_kickoff of the component erofs. Performing a manipulation of the argument sync_decompress results in use after free.
This vulnerability is reported as CVE-2026-53272. The attacker must have access to the local network to execute the attack. No exploit exists.
It is recommended to upgrade the affected component.
GHSA
In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sbi->sync_decompress z_erofs_decompress_kickoff() can race with filesystem unmount, causing a use-aft
ghsa_unreviewed·2026-06-25
CVE-2026-53272 In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sbi->sync_decompress z_erofs_decompress_kickoff() can race with filesystem unmount, causing a use-aft
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix use-after-free on sbi->sync_decompress
z_erofs_decompress_kickoff() can race with filesystem unmount, causing
a use-after-free on sbi->sync_decompress.
When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff()
to queue z_erofs_decompressqueue_work() asynchronously. Then, after all
folios are unlocked, unmount workflow can proceed and sbi will be freed
before accessing to sbi->sync_decompress.
Thread (unmount) I/O completion kworker
queue_work
z_erofs_decompressqueue_work
(all folios are unlocked)
cleanup_mnt
..
erofs_kill_sb
erofs_sb_free
kfree(sbi)
access sbi->sync_decompress // UAF!!
No detection rules found.
No public exploits indexed.
2026-06-25
Published