CVE-2026-53272: erofs: fix use-after-free on sbi->sync_decompress
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix use-after-free on sbi->syncdecompress
zerofsdecompresskickoff() can race with filesystem unmount, causing a use-after-free on sbi->syncdecompress.
When I/O completes, zerofsendio() calls zerofsdecompresskickoff() to queue zerofsdecompressqueuework() asynchronously. Then, after all folios are unlocked, unmount workflow can proceed and sbi will be freed before accessing to sbi->syncdecompress.
Thread (unmount) I/O completion kworker queuework zerofsdecompressqueuework (all folios are unlocked) cleanupmnt .. erofskillsb erofssbfree kfree(sbi) access sbi->syncdecompress // UAF!!
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53272?
CVE-2026-53272 has a risk rating of 40.
How do I fix CVE-2026-53272?
To fix CVE-2026-53272, ensure that you update your Linux kernel to the latest patched version.
What type of vulnerability is CVE-2026-53272?
CVE-2026-53272 is identified as a Use After Free vulnerability.
Which software is affected by CVE-2026-53272?
CVE-2026-53272 affects the Linux kernel specifically related to the erofs filesystem.
What causes the vulnerability in CVE-2026-53272?
CVE-2026-53272 is caused by a race condition between filesystem unmounting and I/O completion.