CVE-2026-53388: fuse: re-lock request before replacing page cache folio
fuse: re-lock request before replacing page cache folio
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.150.1-1 - Configuration
In the affected FUSE code path (fuse_try_move_folio() / replace_page_cache_folio()), ensure lock_request() is invoked before calling replace_page_cache_folio(), so the request remains locked on the success path and fuse_io_args cannot be freed/reused in a way that leads to use-after-free.
Linux kernel (fuse: re-lock request before replacing page cache folio) lock_request() call sequence = Call lock_request() before replace_page_cache_folio() on the success path
Event History
Frequently Asked Questions
What level of access does an attacker need?
The CVSS vector indicates local attack access with low privileges required and no user interaction. The provided data does not indicate that remote network access alone is sufficient.
What security impact could exploitation have?
The vulnerability is rated high severity with a CVSS 3.1 score of 7.8. Its vector assigns high impact to confidentiality, integrity, and availability, consistent with the described use-after-free condition.
Which environments should be prioritized for review?
Review Linux kernel systems that use FUSE, particularly systems running the listed Microsoft azl3 kernel version 6.6.143.1-1. The issue involves FUSE request handling during page-cache folio replacement and request-abort activity.