{"id":"CVE-2026-53381","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtiofs: fix UAF on submount umount\n\niput() called from fuse_release_end() can Oops if the super block has\nalready been destroyed","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtiofs: fix UAF on submount umount\n\niput() called from fuse_release_end() can Oops if the super block has\nalready been destroyed.  Normally this is prevented by waiti…","severity":"high","published":"2026-07-19","updated":"2026-07-19","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53381","references":[{"url":"https://git.kernel.org/stable/c/06b41351779e9289e8785694ade9042ae85e41ea","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0b809199ff87c44487e516a725dd4be2185712ce","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1cc0e3a0c6499aaaa2f21a4fcbba388486afb25e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2181a09ba980f142650fb053666350ead4471cfe","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2abfd3ffbd9452f72535d96ff3982b3ab1f8f2f9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/39a2b95e008665c14f84e50ed411d898df7cd11b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/607a1d4c42f649e6197567c0448fd9ebb316cd42","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/97c4691653d145dcc699eca5d3aba3219a520f1f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e09412a714bcd49375198427bb4aa005037a9d6f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-07-19T16:31:24.351Z","epss":0.00139,"epssPercentile":0.03265,"vendor":"Linux","product":"Linux","affected":["Linux >= 548e1f2bac1d4df91a6138f26bb4ab00323fd948 < 607a1d4c42f649e6197567c0448fd9ebb316cd42","Linux >= cfd1aa3e2b71f3327cb373c45a897c9028c62b35 < 1cc0e3a0c6499aaaa2f21a4fcbba388486afb25e","Linux >= 83b375c6efef69b1066ad2d79601221e7892745a < 0b809199ff87c44487e516a725dd4be2185712ce","Linux >= bfd17b6138df0122a95989457d8e18ce0b86165e < 2181a09ba980f142650fb053666350ead4471cfe","Linux >= b26923512dbe57ae4917bafd31396d22a9d1691a < 97c4691653d145dcc699eca5d3aba3219a520f1f","Linux >= 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 < 2abfd3ffbd9452f72535d96ff3982b3ab1f8f2f9","Linux >= 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 < 39a2b95e008665c14f84e50ed411d898df7cd11b","Linux >= 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 < e09412a714bcd49375198427bb4aa005037a9d6f","Linux >= 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 < 06b41351779e9289e8785694ade9042ae85e41ea","Linux f19a1390af448d9e193c08e28ea5f727bf3c3049","Linux >= 5.10.246 < 5.10.260","Linux >= 5.15.196 < 5.15.211","Linux >= 6.1.158 < 6.1.177","Linux >= 6.6.115 < 6.6.144","Linux >= 6.12.54 < 6.12.95","Linux >= 6.17.4 < 6.18","Linux 6.18"],"cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:29:49.943123Z"},"cvssSource":"cna","slug":"CVE-2026-53381","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvirtiofs: fix UAF on submount umount\n\niput() called from fuse_release_end() can Oops if the super block has\nalready been destroyed.  Normally this is prevented by waiting for\nnum_waiting to go down to zero before commencing with super block shutdown.\n\nThis only works, however, for the last submount instance, as the wait\ncounter is per connection, not per superblock.\n\nRevert to using synchronous release requests for the auto_submounts case,\nwhich is virtiofs only at this time.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":223112,"id":"CVE-2026-53381","ts":1792172296142,"field":"cvss","old":null,"new":"7.8"},{"seq":223111,"id":"CVE-2026-53381","ts":1792172296142,"field":"severity","old":"none","new":"high"}]}