CVE-2026-53272

erofs: fix use-after-free on sbi->sync_decompress

State: Published
Severity: Not scored
Published: Jun 25, 2026
Updated: Oct 30, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix use-after-free on sbi->sync_decompress

z_erofs_decompress_kickoff() can race with filesystem unmount, causing a use-after-free on sbi->sync_decompress.

When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff() to queue z_erofs_decompressqueue_work() asynchronously. Then, after all folios are unlocked, unmount workflow can proceed and sbi will be freed before accessing to sbi->sync_decompress.

Thread (unmount) I/O completion kworker queue_work z_erofs_decompressqueue_work (all folios are unlocked) cleanup_mnt .. erofs_kill_sb erofs_sb_free kfree(sbi) access sbi->sync_decompress // UAF!!

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	40452ffca3c1a0f2994e826f9fa213b107f1a2d4 to before 5627e57f1da68ff0146896eb3d2eed25e62adc44Affected 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 to before 59db5d8bcc65e04d8598afd81ec3a18edb407470Affected 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 to before 86ab00cf81d44b675bb23db62b88fd76c8ac8ceaAffected 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 to before 00bf6868df65fa95b3854996246d15759fdc7070Affected 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 to before 95caf60da33d87ed26c28993620f0d92487b0296Affected 40452ffca3c1a0f2994e826f9fa213b107f1a2d4 to before 1aee05e814d292064bf5fa15733741040cdc48baAffected
LinuxLinux	5.17Affected before 5.17Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.94 through 6.12.Not affected 6.18.36 through 6.18.Not affected 7.0.13 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

40452ffca3c1a0f2994e826f9fa213b107f1a2d4 to before 5627e57f1da68ff0146896eb3d2eed25e62adc44Affected
40452ffca3c1a0f2994e826f9fa213b107f1a2d4 to before 59db5d8bcc65e04d8598afd81ec3a18edb407470Affected
40452ffca3c1a0f2994e826f9fa213b107f1a2d4 to before 86ab00cf81d44b675bb23db62b88fd76c8ac8ceaAffected
40452ffca3c1a0f2994e826f9fa213b107f1a2d4 to before 00bf6868df65fa95b3854996246d15759fdc7070Affected
40452ffca3c1a0f2994e826f9fa213b107f1a2d4 to before 95caf60da33d87ed26c28993620f0d92487b0296Affected
40452ffca3c1a0f2994e826f9fa213b107f1a2d4 to before 1aee05e814d292064bf5fa15733741040cdc48baAffected

LinuxLinux

5.17Affected
before 5.17Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.94 through 6.12.*Not affected
6.18.36 through 6.18.*Not affected
7.0.13 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.