{"id":"CVE-2026-53272","title":"erofs: fix use-after-free on sbi->sync_decompress","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix use-after-free on sbi->sync_decompress\n\nz_erofs_decompress_kickoff() can race with filesystem unmount, causing\na use-after-free on sbi->sync_decompress.\n\nWhe…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 < 59db5d8bcc65e04d8598afd81ec3a18edb407470","Linux >= 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 < 86ab00cf81d44b675bb23db62b88fd76c8ac8cea","Linux >= 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 < 00bf6868df65fa95b3854996246d15759fdc7070","Linux >= 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 < 95caf60da33d87ed26c28993620f0d92487b0296","Linux >= 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 < 1aee05e814d292064bf5fa15733741040cdc48ba","Linux 5.17"],"published":"2026-06-25","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:42:21.684Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53272","references":[{"url":"https://git.kernel.org/stable/c/59db5d8bcc65e04d8598afd81ec3a18edb407470"},{"url":"https://git.kernel.org/stable/c/86ab00cf81d44b675bb23db62b88fd76c8ac8cea"},{"url":"https://git.kernel.org/stable/c/00bf6868df65fa95b3854996246d15759fdc7070"},{"url":"https://git.kernel.org/stable/c/95caf60da33d87ed26c28993620f0d92487b0296"},{"url":"https://git.kernel.org/stable/c/1aee05e814d292064bf5fa15733741040cdc48ba"}],"tags":["cve.org"],"epss":0.00117,"epssPercentile":0.01554,"ingestedAt":"2026-10-21T12:48:53.618Z","slug":"CVE-2026-53272","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix use-after-free on sbi->sync_decompress\n\nz_erofs_decompress_kickoff() can race with filesystem unmount, causing\na use-after-free on sbi->sync_decompress.\n\nWhen I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff()\nto queue z_erofs_decompressqueue_work() asynchronously. Then, after all\nfolios are unlocked, unmount workflow can proceed and sbi will be freed\nbefore accessing to sbi->sync_decompress.\n\nThread (unmount)        I/O completion        kworker\n                        queue_work\n                                              z_erofs_decompressqueue_work\n                                               (all folios are unlocked)\ncleanup_mnt\n ..\n erofs_kill_sb\n  erofs_sb_free\n   kfree(sbi)\n                        access sbi->sync_decompress  // UAF!!\n\n## Affected\n\n- `Linux >= 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 < 59db5d8bcc65e04d8598afd81ec3a18edb407470`\n- `Linux >= 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 < 86ab00cf81d44b675bb23db62b88fd76c8ac8cea`\n- `Linux >= 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 < 00bf6868df65fa95b3854996246d15759fdc7070`\n- `Linux >= 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 < 95caf60da33d87ed26c28993620f0d92487b0296`\n- `Linux >= 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 < 1aee05e814d292064bf5fa15733741040cdc48ba`\n- `Linux 5.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}