OSG-SEC-2026-07-20b Linux Kernel Fuse fs/fuse/file.c fuse_try_move_folio folios/mapping use after free (CVE-2026-53388)
Dear OSG Security Contacts,
A flaw was identified in the Linux kernel's Filesystem in Userspace (FUSE) component. After a request is unlocked, it may continue processing after memory associated with the request has already been released, creating a use-after-free condition. Successful exploitation could result in a denial of service or potentially arbitrary code execution. ## WHAT ARE THE VULNERABILITIES: CVE-2026-53388 is caused by improper request synchronization within the Linux kernel's FUSE subsystem. The issue occurs in the fuse_try_move_folio() function, which manages page cache folios. On the successful execution path, the function unlocks a request but fails to re-acquire the lock before continuing, allowing fuse_chan_abort() to prematurely free the associated fuse_io_args structure. This results in a use-after-free condition that could allow a local attacker to cause a denial of service or potentially execute arbitrary code.
IMPACTED VERSIONS:
Linux Kernel up to 7.1.1 affected. Upstream fixes are available beginning with versions 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.37, 7.0.14, and 7.1.2
Red Hat Enterprise Linux RHEL 7 - Affected RHEL 8 - Affected RHEL 9 - Affected RHEL 10 - Affected Red Hat has identified the affected packages, but security errata are not yet available. Debian Debian has identified affected distros. Fixes available for bookworm, trixie and sid. Ubuntu Ubuntu is evaluating affected packages.
WHAT YOU SHOULD DO:
Apply vendor-provided kernel updates addressing CVE-2026-53388 when they become available. A system reboot is required after installing the updated kernel for the changes to take effect. Prioritize systems that provide access to unprivileged users or make use of FUSE-based filesystems.
REFERENCES
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-53388
[2] https://access.redhat.com/security/cve/cve-2026-53388
[3] https://vuldb.com/vuln/380120
[4] https://www.cve.org/CVERecord?id=CVE-2026-53388
[5] https://security-tracker.debian.org/tracker/CVE-2026-53388
Please contact the OSG security team at [email protected] if you have any questions or concerns.
OSG Security Team