CVE-2026-53272

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix use-after-free on sbi->sync_decompress

z_erofs_decompress_kickoff() can race with filesystem unmount, causing a use-after-free on sbi->sync_decompress.

When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff() to queue z_erofs_decompressqueue_work() asynchronously. Then, after all folios are unlocked, unmount workflow can proceed and sbi will be freed before accessing to sbi->sync_decompress.

Thread (unmount) I/O completion kworker queue_work z_erofs_decompressqueue_work (all folios are unlocked) cleanup_mnt .. erofs_kill_sb erofs_sb_free kfree(sbi) access sbi->sync_decompress // UAF!!

This vulnerability is rated as having a Moderate impact because exploitation requires local access and specific filesystem interaction, restricting the blast radius primarily to a denial of service through a kernel crash. Triggering the race condition requires an attacker to initiate concurrent I/O and unmount operations on an EROFS filesystem, a workflow typically restricted to privileged users or specific container environments. Additionally, older enterprise platforms such as Red Hat Enterprise Linux 8 and 9 are not affected as the vulnerable code is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.