---
id: CVE-2026-53388
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fuse: re-lock request before replacing page cache folio

  fuse_try_move_folio() unlocks the request on entry but does not
  re-lock it on the success path
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fuse: re-lock request before replacing page cache folio

  fuse_try_move_folio() unlocks the request on entry but does not
  re-lock it on the success path. This means fuse…
severity: high
published: '2026-07-19'
updated: '2026-07-19'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53388'
references:
  - url: 'https://git.kernel.org/stable/c/0223f452532d9cd8a5e87c45de828fd93c99bd25'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/030fe3e9d8abdee303dd7e9e42f45082d382a407'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/46473ddccdc5065033e397d6e62c280dbcd3d9c2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5927b43a4f8d89e86930f524bf63e9c7e66f61b4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7c18691e0cfda29672f79bafde8abdb7710674f6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a078484921052d0badd827fcc2770b5cfc1d4120'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/af2892249d982a1c036ca456cc135374e68b6677'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e28db6ac4792d065ab32565fd9f0a2361c3d4666'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53388.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-53388'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2502255'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-53388'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53388'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026071935-CVE-2026-53388-eeaf@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2026:89083'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-07-19T20:33:10.551Z'
epss: 0.00133
epssPercentile: 0.02805
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ce534fb052928ce556639d7ecf01cbf4e01321e1 <
    7c18691e0cfda29672f79bafde8abdb7710674f6
  - >-
    Linux >= ce534fb052928ce556639d7ecf01cbf4e01321e1 <
    5927b43a4f8d89e86930f524bf63e9c7e66f61b4
  - >-
    Linux >= ce534fb052928ce556639d7ecf01cbf4e01321e1 <
    030fe3e9d8abdee303dd7e9e42f45082d382a407
  - >-
    Linux >= ce534fb052928ce556639d7ecf01cbf4e01321e1 <
    46473ddccdc5065033e397d6e62c280dbcd3d9c2
  - >-
    Linux >= ce534fb052928ce556639d7ecf01cbf4e01321e1 <
    af2892249d982a1c036ca456cc135374e68b6677
  - >-
    Linux >= ce534fb052928ce556639d7ecf01cbf4e01321e1 <
    0223f452532d9cd8a5e87c45de828fd93c99bd25
  - >-
    Linux >= ce534fb052928ce556639d7ecf01cbf4e01321e1 <
    e28db6ac4792d065ab32565fd9f0a2361c3d4666
  - >-
    Linux >= ce534fb052928ce556639d7ecf01cbf4e01321e1 <
    a078484921052d0badd827fcc2770b5cfc1d4120
  - Linux 2.6.35
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:30:00.282945Z'
cvssSource: cna
patched:
  - enterprise_linux_baseos_v_8
  - enterprise_linux_crb_v_8
cwe:
  - CWE-825
scores:
  cna: 7.8
  vendor: 7
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fuse: re-lock request before replacing page cache folio

fuse_try_move_folio() unlocks the request on entry but does not
re-lock it on the success path. This means fuse_chan_abort() can end the
request and free the fuse_io_args (eg fuse_readpages_end()) while the
subsequent copy chain logic after fuse_try_move_folio() accesses the
fuse_io_args, leading to use-after-free issues.

Fix this by calling lock_request() before replace_page_cache_folio().
This ensures the request is locked on the success path which will
prevent the fuse_io_args from being freed while the later copying logic
runs, and also ensures that the ap->folios[i]->mapping is never null
since ap->folios[i] will always point to the newfolio after
replace_page_cache_folio().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:89083** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-10-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:89083)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53388.json)