Linux FUSE UAF: re-lock request prior to replace_page_cache_folio
CVE-2026-53388 Published on July 19, 2026
fuse: re-lock request before replacing page cache folio
In the Linux kernel, the following vulnerability has been resolved:
fuse: re-lock request before replacing page cache folio
fuse_try_move_folio() unlocks the request on entry but does not
re-lock it on the success path. This means fuse_chan_abort() can end the
request and free the fuse_io_args (eg fuse_readpages_end()) while the
subsequent copy chain logic after fuse_try_move_folio() accesses the
fuse_io_args, leading to use-after-free issues.
Fix this by calling lock_request() before replace_page_cache_folio().
This ensures the request is locked on the success path which will
prevent the fuse_io_args from being freed while the later copying logic
runs, and also ensures that the ap->folios[i]->mapping is never null
since ap->folios[i] will always point to the newfolio after
replace_page_cache_folio().
Products Associated with CVE-2026-53388
stack.watch emails you whenever new vulnerabilities are published in Linux Kernel or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
Linux:- Version ce534fb052928ce556639d7ecf01cbf4e01321e1 and below 7c18691e0cfda29672f79bafde8abdb7710674f6 is affected.
- Version ce534fb052928ce556639d7ecf01cbf4e01321e1 and below 5927b43a4f8d89e86930f524bf63e9c7e66f61b4 is affected.
- Version ce534fb052928ce556639d7ecf01cbf4e01321e1 and below 030fe3e9d8abdee303dd7e9e42f45082d382a407 is affected.
- Version ce534fb052928ce556639d7ecf01cbf4e01321e1 and below 46473ddccdc5065033e397d6e62c280dbcd3d9c2 is affected.
- Version ce534fb052928ce556639d7ecf01cbf4e01321e1 and below af2892249d982a1c036ca456cc135374e68b6677 is affected.
- Version ce534fb052928ce556639d7ecf01cbf4e01321e1 and below 0223f452532d9cd8a5e87c45de828fd93c99bd25 is affected.
- Version ce534fb052928ce556639d7ecf01cbf4e01321e1 and below e28db6ac4792d065ab32565fd9f0a2361c3d4666 is affected.
- Version ce534fb052928ce556639d7ecf01cbf4e01321e1 and below a078484921052d0badd827fcc2770b5cfc1d4120 is affected.
- Version 2.6.35 is affected.
- Before 2.6.35 is unaffected.
- Version 5.15.211, <= 5.15.* is unaffected.
- Version 6.1.177, <= 6.1.* is unaffected.
- Version 6.6.144, <= 6.6.* is unaffected.
- Version 6.12.95, <= 6.12.* is unaffected.
- Version 6.18.37, <= 6.18.* is unaffected.
- Version 7.0.14, <= 7.0.* is unaffected.
- Version 7.1.2, <= 7.1.* is unaffected.
- Version 7.2, <= * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.