CVE-2026-53129: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53129 Overview

CVE-2026-53129 is a use-after-free vulnerability in the Linux kernel's fs/mbcache subsystem. The flaw resides in mb_cache_destroy(), which frees the metadata block cache without first canceling the pending c_shrink_work work item. If mb_cache_entry_create() has scheduled c_shrink_work and the worker is still pending or running during teardown, mb_cache_shrink_worker() dereferences cache memory after it has been freed. The condition is reachable when the last reference to a mounted ext2, ext4, or ocfs2 filesystem is dropped.

Critical Impact
A privileged local user with root or CAP_SYS_ADMIN can trigger a kernel use-after-free during filesystem unmount, leading to memory corruption and potential kernel compromise.

Affected Products

Linux kernel fs/mbcache subsystem
Filesystems relying on mbcache: ext2, ext4, and ocfs2
Stable kernel branches addressed by commits 0e4eff3, a88d39a, b25fd35, and d227786

Discovery Timeline

2026-06-24 - CVE-2026-53129 published to the National Vulnerability Database (NVD)
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53129

Vulnerability Analysis

The metadata block cache (mbcache) provides shared extended-attribute lookup support for filesystems including ext2, ext4, and ocfs2. Each cache instance owns a deferred shrinker callback, c_shrink_work, which mb_cache_entry_create() schedules through schedule_work() when the entry population exceeds the configured threshold.

When a filesystem is unmounted, mb_cache_destroy() calls shrinker_free() and proceeds to release every cache entry along with the cache structure itself. The destructor does not flush or cancel the queued c_shrink_work item before tearing the cache down. A worker that is still pending on the workqueue or actively executing inside mb_cache_shrink_worker() continues to dereference the freed struct mb_cache, producing a use-after-free condition in kernel address space.

Root Cause

The root cause is a missing synchronization step in the destruction path. The lifecycle of the c_shrink_work workqueue item is not bounded by the lifetime of its owning cache. mb_cache_destroy() assumes that freeing the shrinker is sufficient, but schedule_work() may have already queued an execution that the workqueue subsystem has not yet dispatched, or that is mid-execution when the cache memory is released.

Attack Vector

Exploitation requires local privileges equivalent to root or CAP_SYS_ADMIN because the trigger is the final put on a mounted ext2, ext4, or ocfs2 filesystem. An attacker who can mount and unmount filesystems can race entry creation against destruction to leave c_shrink_work pending across the call to mb_cache_destroy(). The freed cache memory is then accessed by the worker, which can be leveraged for kernel memory corruption.

No public proof-of-concept is currently associated with this CVE. Refer to the upstream fixes for the precise call paths: Kernel Git Commit 0e4eff3, Kernel Git Commit a88d39a, Kernel Git Commit b25fd35, and Kernel Git Commit d227786.

Detection Methods for CVE-2026-53129

Indicators of Compromise

Kernel BUG, KASAN: use-after-free, or general protection fault messages referencing mb_cache_shrink_worker or mb_cache_destroy in dmesg or /var/log/kern.log.
Unexpected kernel panics or oopses occurring near umount operations on ext2, ext4, or ocfs2 filesystems.
Repeated mount/umount activity from non-administrative workflows on hosts running unpatched kernels.

Detection Strategies

Run kernels built with KASAN in test environments to surface use-after-free reports tied to mbcache during filesystem teardown.
Audit installed kernel versions against the fixed commits and flag hosts that lack the stable backports.
Correlate umount syscall telemetry with subsequent kernel taint or oops events to identify exploitation attempts.

Monitoring Recommendations

Forward kernel ring buffer and journald events to a centralized log pipeline and alert on use-after-free or mbcache strings.
Monitor for privileged invocations of mount(2) and umount(2) from unexpected user sessions or container workloads granted CAP_SYS_ADMIN.
Track loaded filesystem modules (ext2, ext4, ocfs2) on hosts where they are not required and remove them where possible.

How to Mitigate CVE-2026-53129

Immediate Actions Required

Update to a Linux kernel release containing commits 0e4eff3, a88d39a, b25fd35, or d227786 from the stable trees.
Restrict CAP_SYS_ADMIN and root-equivalent privileges; remove unnecessary mount capabilities from container runtimes and service accounts.
Reboot affected hosts after applying the kernel update to ensure the patched code path is active.

Patch Information

The upstream fix replaces the unsynchronized teardown with a cancel_work_sync() call placed before shrinker_free(). This guarantees that any pending or in-flight c_shrink_work execution completes and cannot be rescheduled before the cache structure is freed. Distribution kernels should pick up the corresponding stable backports identified by the commit hashes referenced above.

Workarounds

Where patching is not immediately possible, prevent unprivileged or semi-privileged contexts from mounting and unmounting ext2, ext4, or ocfs2 filesystems.
Disable user namespaces or restrict CAP_SYS_ADMIN inside containers to reduce the population of principals able to reach the vulnerable code path.
Avoid loading the ext2 and ocfs2 modules on systems that do not require them; blacklist them in /etc/modprobe.d/ until the kernel is updated.

bash

# Verify the running kernel and confirm the mbcache fix is applied
uname -r

# Example: blacklist unused filesystem modules until patching completes
cat <<'EOF' | sudo tee /etc/modprobe.d/disable-legacy-fs.conf
blacklist ext2
blacklist ocfs2
EOF

# Restrict mount capabilities for non-root users via sudoers policy review
sudo grep -RE 'mount|umount' /etc/sudoers /etc/sudoers.d/