In the Linux kernel, the following vulnerability has been resolved:

virtiofs: fix UAF on submount umount

iput() called from fuse_release_end() can Oops if the super block has
already been destroyed. Normally this is prevented by waiting for
num_waiting to go down to zero before commencing with super block shutdown.

This only works, however, for the last submount instance, as the wait
counter is per connection, not per superblock.

Revert to using synchronous release requests for the auto_submounts case,
which is virtiofs only at this time.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00195.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
548e1f2bac1d4df91a6138f26bb4ab00323fd948 affected < 607a1d4c42f649e6197567c0448fd9ebb316cd42
cfd1aa3e2b71f3327cb373c45a897c9028c62b35 affected < 1cc0e3a0c6499aaaa2f21a4fcbba388486afb25e
83b375c6efef69b1066ad2d79601221e7892745a affected < 0b809199ff87c44487e516a725dd4be2185712ce
bfd17b6138df0122a95989457d8e18ce0b86165e affected < 2181a09ba980f142650fb053666350ead4471cfe
b26923512dbe57ae4917bafd31396d22a9d1691a affected < 97c4691653d145dcc699eca5d3aba3219a520f1f
26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 affected < 2abfd3ffbd9452f72535d96ff3982b3ab1f8f2f9
26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 affected < 39a2b95e008665c14f84e50ed411d898df7cd11b
26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 affected < e09412a714bcd49375198427bb4aa005037a9d6f
26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 affected < 06b41351779e9289e8785694ade9042ae85e41ea
f19a1390af448d9e193c08e28ea5f727bf3c3049 affected —
5.10.246 affected < 5.10.260
5.15.196 affected < 5.15.211
6.1.158 affected < 6.1.177
6.6.115 affected < 6.6.144
6.12.54 affected < 6.12.95
6.17.4 affected < 6.18
Linux Linux affected
Version Status Constraints
6.18 affected —
0 unaffected < 6.18
5.10.260 unaffected ≤ 5.10.*
5.15.211 unaffected ≤ 5.15.*
6.1.177 unaffected ≤ 6.1.*
6.6.144 unaffected ≤ 6.6.*
6.12.95 unaffected ≤ 6.12.*
6.18.37 unaffected ≤ 6.18.*
7.0.14 unaffected ≤ 7.0.*
7.1.2 unaffected ≤ 7.1.*
7.2-rc1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/06b41351779e9289e8785694ade9042ae85e41ea cve-icon
https://git.kernel.org/stable/c/0b809199ff87c44487e516a725dd4be2185712ce cve-icon
https://git.kernel.org/stable/c/1cc0e3a0c6499aaaa2f21a4fcbba388486afb25e cve-icon
https://git.kernel.org/stable/c/2181a09ba980f142650fb053666350ead4471cfe cve-icon
https://git.kernel.org/stable/c/2abfd3ffbd9452f72535d96ff3982b3ab1f8f2f9 cve-icon
https://git.kernel.org/stable/c/39a2b95e008665c14f84e50ed411d898df7cd11b cve-icon
https://git.kernel.org/stable/c/607a1d4c42f649e6197567c0448fd9ebb316cd42 cve-icon
https://git.kernel.org/stable/c/97c4691653d145dcc699eca5d3aba3219a520f1f cve-icon
https://git.kernel.org/stable/c/e09412a714bcd49375198427bb4aa005037a9d6f cve-icon
https://lore.kernel.org/linux-cve-announce/2026071931-CVE-2026-53381-73c3@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-53381 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-53381 cve-icon
History

Tue, 21 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 20 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Sun, 19 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput() called from fuse_release_end() can Oops if the super block has already been destroyed. Normally this is prevented by waiting for num_waiting to go down to zero before commencing with super block shutdown. This only works, however, for the last submount instance, as the wait counter is per connection, not per superblock. Revert to using synchronous release requests for the auto_submounts case, which is virtiofs only at this time.
Title virtiofs: fix UAF on submount umount
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-20T13:39:46.855Z

Reserved: 2026-06-09T07:44:35.401Z

Link: CVE-2026-53381

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-53381 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T01:45:05Z

Weaknesses