CVE-2026-53381 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

virtiofs: fix UAF on submount umount

iput() called from fuse_release_end() can Oops if the super block has
already been destroyed. Normally this is prevented by waiting for
num_waiting to go down to zero before commencing with super block shutdown.

This only works, however, for the last submount instance, as the wait
counter is per connection, not per superblock.

Revert to using synchronous release requests for the auto_submounts case,
which is virtiofs only at this time.

Published: 2026-07-19

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw in the Linux kernel's virtiofs subsystem is a use‑after‑free condition triggered during the unmount of a sub‑mount. The function iput() may be invoked after the super‑block has been destroyed, leading to a kernel Oops and a system crash. This crash represents only a denial‑of‑service impact and does not allow an attacker to execute arbitrary code or elevate privileges based on the information supplied.

Affected Systems

All Linux kernel builds that include the virtiofs filesystem are potentially vulnerable; no specific version range is mentioned in the advisory.

Risk and Exploitability

The CVSS score of 7.8 highlights a high severity flaw, while the EPSS score of less than 1% suggests a low likelihood of active exploitation. The vulnerability is not listed in CISA's KEV catalog. Based on the description, exploitation would most likely require a local process that can initiate an unmount of a virtiofs sub‑mount, making the threat primarily local.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`548e1f2bac1d4df91a6138f26bb4ab00323fd948`	affected	< 607a1d4c42f649e6197567c0448fd9ebb316cd42
`cfd1aa3e2b71f3327cb373c45a897c9028c62b35`	affected	< 1cc0e3a0c6499aaaa2f21a4fcbba388486afb25e
`83b375c6efef69b1066ad2d79601221e7892745a`	affected	< 0b809199ff87c44487e516a725dd4be2185712ce
`bfd17b6138df0122a95989457d8e18ce0b86165e`	affected	< 2181a09ba980f142650fb053666350ead4471cfe
`b26923512dbe57ae4917bafd31396d22a9d1691a`	affected	< 97c4691653d145dcc699eca5d3aba3219a520f1f
`26e5c67deb2e1f42a951f022fdf5b9f7eb747b01`	affected	< 2abfd3ffbd9452f72535d96ff3982b3ab1f8f2f9
`26e5c67deb2e1f42a951f022fdf5b9f7eb747b01`	affected	< 39a2b95e008665c14f84e50ed411d898df7cd11b
`26e5c67deb2e1f42a951f022fdf5b9f7eb747b01`	affected	< e09412a714bcd49375198427bb4aa005037a9d6f
`26e5c67deb2e1f42a951f022fdf5b9f7eb747b01`	affected	< 06b41351779e9289e8785694ade9042ae85e41ea
`f19a1390af448d9e193c08e28ea5f727bf3c3049`	affected	—
`5.10.246`	affected	< 5.10.260
`5.15.196`	affected	< 5.15.211
`6.1.158`	affected	< 6.1.177
`6.6.115`	affected	< 6.6.144
`6.12.54`	affected	< 6.12.95
`6.17.4`	affected	< 6.18

Linux

affected

Version	Status	Constraints
`6.18`	affected	—
`0`	unaffected	< 6.18
`5.10.260`	unaffected	≤ 5.10.*
`5.15.211`	unaffected	≤ 5.15.*
`6.1.177`	unaffected	≤ 6.1.*
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.37`	unaffected	≤ 6.18.*
`7.0.14`	unaffected	≤ 7.0.*
`7.1.2`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[548e1f2bac1d4df91a6138f26bb4ab00323fd948,607a1d4c42f649e6197567c0448fd9ebb316cd42)`	affected	code_commit	—
`[cfd1aa3e2b71f3327cb373c45a897c9028c62b35,1cc0e3a0c6499aaaa2f21a4fcbba388486afb25e)`	affected	code_commit	—
`[83b375c6efef69b1066ad2d79601221e7892745a,0b809199ff87c44487e516a725dd4be2185712ce)`	affected	code_commit	—
`[bfd17b6138df0122a95989457d8e18ce0b86165e,2181a09ba980f142650fb053666350ead4471cfe)`	affected	code_commit	—
`[b26923512dbe57ae4917bafd31396d22a9d1691a,97c4691653d145dcc699eca5d3aba3219a520f1f)`	affected	code_commit	—
`[26e5c67deb2e1f42a951f022fdf5b9f7eb747b01,2abfd3ffbd9452f72535d96ff3982b3ab1f8f2f9)`	affected	code_commit	—
`[26e5c67deb2e1f42a951f022fdf5b9f7eb747b01,39a2b95e008665c14f84e50ed411d898df7cd11b)`	affected	code_commit	—
`[26e5c67deb2e1f42a951f022fdf5b9f7eb747b01,e09412a714bcd49375198427bb4aa005037a9d6f)`	affected	code_commit	—
`[26e5c67deb2e1f42a951f022fdf5b9f7eb747b01,06b41351779e9289e8785694ade9042ae85e41ea)`	affected	code_commit	—
`f19a1390af448d9e193c08e28ea5f727bf3c3049`	affected	code_commit	—
`[5.10.246,5.10.260)`	affected	semver	—
`[5.15.196,5.15.211)`	affected	semver	—
`[6.1.158,6.1.177)`	affected	semver	—
`[6.6.115,6.6.144)`	affected	semver	—
`[6.12.54,6.12.95)`	affected	semver	—
`[6.17.4,6.18)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.18`	affected	semver	—
`[0,6.18)`	unaffected	generic	—
`[5.10.260,5.10.*]`	unaffected	generic	—
`[5.15.211,5.15.*]`	unaffected	generic	—
`[6.1.177,6.1.*]`	unaffected	generic	—
`[6.6.144,6.6.*]`	unaffected	generic	—
`[6.12.95,6.12.*]`	unaffected	generic	—
`[6.18.37,6.18.*]`	unaffected	generic	—
`[7.0.14,7.0.*]`	unaffected	generic	—
`[7.1.2,7.1.*]`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that incorporates the virtiofs use‑after‑free fix.
If a kernel upgrade is not immediately possible, limit the ability to unmount virtiofs sub‑mounts to trusted or privileged processes only.
Enable kernel hardening options such as CONFIG_DEBUG_KERNEL or page-guard to reduce the impact of memory corruption.

Generated by OpenCVE AI on August 1, 2026 at 08:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4700-1	linux-6.1 security update
Debian DLA	DLA-4717-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00139.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/06b41351779e9289e8785694ade9042ae85e41ea
https://git.kernel.org/stable/c/0b809199ff87c44487e516a725dd4be2185712ce
https://git.kernel.org/stable/c/1cc0e3a0c6499aaaa2f21a4fcbba388486afb25e
https://git.kernel.org/stable/c/2181a09ba980f142650fb053666350ead4471cfe
https://git.kernel.org/stable/c/2abfd3ffbd9452f72535d96ff3982b3ab1f8f2f9
https://git.kernel.org/stable/c/39a2b95e008665c14f84e50ed411d898df7cd11b
https://git.kernel.org/stable/c/607a1d4c42f649e6197567c0448fd9ebb316cd42
https://git.kernel.org/stable/c/97c4691653d145dcc699eca5d3aba3219a520f1f
https://git.kernel.org/stable/c/e09412a714bcd49375198427bb4aa005037a9d6f
https://lore.kernel.org/linux-cve-announce/2026071931-CVE-2026-53381-73c3@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53381
https://www.cve.org/CVERecord?id=CVE-2026-53381

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026071931-CVE-2026-53381-73c3@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53381 https://www.cve.org/CVERecord?id=CVE-2026-53381
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput() called from fuse_release_end() can Oops if the super block has already been destroyed. Normally this is prevented by waiting for num_waiting to go down to zero before commencing with super block shutdown. This only works, however, for the last submount instance, as the wait counter is per connection, not per superblock. Revert to using synchronous release requests for the auto_submounts case, which is virtiofs only at this time.
Title		virtiofs: fix UAF on submount umount
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/06b41351779e9289e8785694ade9042ae85e41ea https://git.kernel.org/stable/c/0b809199ff87c44487e516a725dd4be2185712ce https://git.kernel.org/stable/c/1cc0e3a0c6499aaaa2f21a4fcbba388486afb25e https://git.kernel.org/stable/c/2181a09ba980f142650fb053666350ead4471cfe https://git.kernel.org/stable/c/2abfd3ffbd9452f72535d96ff3982b3ab1f8f2f9 https://git.kernel.org/stable/c/39a2b95e008665c14f84e50ed411d898df7cd11b https://git.kernel.org/stable/c/607a1d4c42f649e6197567c0448fd9ebb316cd42 https://git.kernel.org/stable/c/97c4691653d145dcc699eca5d3aba3219a520f1f https://git.kernel.org/stable/c/e09412a714bcd49375198427bb4aa005037a9d6f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T11:59:30.469Z

Updated: 2026-08-05T12:35:21.826Z

Reserved: 2026-06-09T07:44:35.401Z

Link: CVE-2026-53381

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-53381 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-01T08:15:03Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object