7.8

CVE-2026-53388

fuse: re-lock request before replacing page cache folio

In the Linux kernel, the following vulnerability has been resolved:

fuse: re-lock request before replacing page cache folio

fuse_try_move_folio() unlocks the request on entry but does not
re-lock it on the success path. This means fuse_chan_abort() can end the
request and free the fuse_io_args (eg fuse_readpages_end()) while the
subsequent copy chain logic after fuse_try_move_folio() accesses the
fuse_io_args, leading to use-after-free issues.

Fix this by calling lock_request() before replace_page_cache_folio().
This ensures the request is locked on the success path which will
prevent the fuse_io_args from being freed while the later copying logic
runs, and also ensures that the ap->folios[i]->mapping is never null
since ap->folios[i] will always point to the newfolio after
replace_page_cache_folio().
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.6.35 < 5.15.211
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.177
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.144
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.95
Linux ≫ Linux Kernel Version >= 6.13 < 6.18.37
Linux ≫ Linux Kernel Version >= 6.19 < 7.0.14
Linux ≫ Linux Kernel Version >= 7.1 < 7.1.2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.032
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/7c18691e0cfda29672f79bafde8abdb7710674f6
Patch
https://git.kernel.org/stable/c/5927b43a4f8d89e86930f524bf63e9c7e66f61b4
Patch
https://git.kernel.org/stable/c/030fe3e9d8abdee303dd7e9e42f45082d382a407
Patch
https://git.kernel.org/stable/c/46473ddccdc5065033e397d6e62c280dbcd3d9c2
Patch
https://git.kernel.org/stable/c/af2892249d982a1c036ca456cc135374e68b6677
Patch
https://git.kernel.org/stable/c/0223f452532d9cd8a5e87c45de828fd93c99bd25
Patch
https://git.kernel.org/stable/c/e28db6ac4792d065ab32565fd9f0a2361c3d4666
Patch
https://git.kernel.org/stable/c/a078484921052d0badd827fcc2770b5cfc1d4120
Patch