CVE-2026-53381

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the virtiofs component during submount umount operations. The iput() function, when called from fuse release end(), can cause a system crash (Oops) if the super block has already been destroyed. This occurs because the num waiting counter, used to prevent super block shutdown, is tracked per connection rather than per superblock, making it ineffective for all but the last submount instance. This flaw may lead to local privilege escalation, code execution, and system compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.