---
id: CVE-2026-53388
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fuse: re-lock request before replacing page cache folio

  fuse_try_move_folio() unlocks the request on entry but does not
  re-lock it on the success path
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fuse: re-lock request before replacing page cache folio

  fuse_try_move_folio() unlocks the request on entry but does not
  re-lock it on the success path. This means fuse…
severity: none
published: '2026-07-19'
updated: '2026-07-19'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53388'
references:
  - url: 'https://git.kernel.org/stable/c/0223f452532d9cd8a5e87c45de828fd93c99bd25'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/030fe3e9d8abdee303dd7e9e42f45082d382a407'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/46473ddccdc5065033e397d6e62c280dbcd3d9c2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5927b43a4f8d89e86930f524bf63e9c7e66f61b4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7c18691e0cfda29672f79bafde8abdb7710674f6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a078484921052d0badd827fcc2770b5cfc1d4120'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/af2892249d982a1c036ca456cc135374e68b6677'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e28db6ac4792d065ab32565fd9f0a2361c3d4666'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
ingestedAt: '2026-07-19T20:33:10.551Z'
epss: 0.00133
epssPercentile: 0.02293
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fuse: re-lock request before replacing page cache folio

fuse_try_move_folio() unlocks the request on entry but does not
re-lock it on the success path. This means fuse_chan_abort() can end the
request and free the fuse_io_args (eg fuse_readpages_end()) while the
subsequent copy chain logic after fuse_try_move_folio() accesses the
fuse_io_args, leading to use-after-free issues.

Fix this by calling lock_request() before replace_page_cache_folio().
This ensures the request is locked on the success path which will
prevent the fuse_io_args from being freed while the later copying logic
runs, and also ensures that the ap->folios[i]->mapping is never null
since ap->folios[i] will always point to the newfolio after
replace_page_cache_folio().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.