CVE-2026-53381: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53381 Overview

CVE-2026-53381 is a use-after-free (UAF) vulnerability in the Linux kernel's virtiofs filesystem driver. The flaw occurs during submount unmount operations, where iput() called from fuse_release_end() can dereference a super block that has already been destroyed. The protection mechanism that waits for num_waiting to reach zero before super block shutdown operates per connection, not per superblock, leaving submount instances exposed. The fix reverts to synchronous release requests for the auto_submounts case, which currently applies only to virtiofs.

Critical Impact
A local, low-privileged user interacting with virtiofs submounts can trigger a kernel use-after-free, resulting in denial of service through a kernel oops or potential local privilege escalation.

Affected Products

Linux kernel versions containing the virtiofs submount handling with auto_submounts behavior
Guest systems using virtiofs to mount host-shared directories
Virtualization stacks relying on FUSE/virtiofs auto-submount functionality

Discovery Timeline

2026-07-19 - CVE-2026-53381 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-53381

Vulnerability Analysis

The vulnerability resides in the FUSE release path used by virtiofs. When a submount is being torn down, fuse_release_end() invokes iput() on an inode whose backing super block may already have been freed. The FUSE connection tracks outstanding asynchronous operations through the num_waiting counter and waits for it to drain before allowing shutdown. Because this counter is maintained per FUSE connection rather than per super block, only the final submount tied to the connection is properly synchronized. All other submounts can complete their teardown while asynchronous release requests are still in flight against them, producing a classic use-after-free condition on the super block.

Root Cause

The root cause is a scope mismatch in the synchronization primitive protecting super block lifetime. The wait on num_waiting operates at connection granularity, but super blocks are per-submount. When multiple submounts share a connection, freeing an intermediate submount's super block does not block on that submount's own pending asynchronous release requests. When those requests later complete and call iput(), they access freed memory [CWE-416].

Attack Vector

Exploitation requires local access with the ability to interact with virtiofs submounts. An attacker with permission to trigger mount and unmount operations on virtiofs auto-submounts can race the release path against super block destruction. Successful exploitation causes a kernel oops, and freed-object reuse conditions in the kernel slab allocator can, in principle, be leveraged for privilege escalation. The vulnerability is not remotely reachable and requires no user interaction beyond the attacker's own actions.

No public proof-of-concept code has been released. The upstream fix replaces asynchronous release with synchronous release requests for the auto_submounts code path, ensuring the iput() completes before the super block is torn down.

Detection Methods for CVE-2026-53381

Indicators of Compromise

Kernel oops or panic messages referencing fuse_release_end, iput, or virtio_fs in dmesg and /var/log/kern.log
Slab corruption warnings from KASAN or SLUB_DEBUG naming FUSE inode or super block structures
Unexpected process termination or hang during virtiofs submount unmount operations

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface the use-after-free during QA of virtiofs workloads
Monitor kernel ring buffers on guest VMs for oops signatures involving fuse_release_end following umount events
Correlate umount syscall audit records with subsequent kernel warnings to identify race exploitation attempts

Monitoring Recommendations

Ingest guest dmesg and auditd telemetry into a centralized log platform and alert on kernel oops or FUSE-related BUG messages
Track kernel version inventory across virtualized workloads to identify hosts running unpatched Linux builds
Baseline legitimate mount and unmount activity so anomalous submount churn from a single UID is flagged for review

How to Mitigate CVE-2026-53381

Immediate Actions Required

Apply the upstream Linux stable kernel patches referenced by commits 06b41351, 0b809199, 1cc0e3a0, 2181a09b, 2abfd3ff, 39a2b95e, 607a1d4c, 97c46916, and e09412a7
Update guest VM kernels that consume virtiofs to a fixed stable release from your distribution
Restrict local access on multi-tenant guests so untrusted users cannot trigger arbitrary mount and unmount operations

Patch Information

The fix is merged across multiple stable branches. Refer to the upstream commits: Linux Kernel Commit 06b4135, Linux Kernel Commit 0b80919, Linux Kernel Commit 1cc0e3a, Linux Kernel Commit 2181a09, Linux Kernel Commit 2abfd3f, Linux Kernel Commit 39a2b95, Linux Kernel Commit 607a1d4, Linux Kernel Commit 97c4691, and Linux Kernel Commit e09412a. The patch forces synchronous FUSE release requests when auto_submounts is enabled.

Workarounds

Disable virtiofs auto-submount functionality on guests that do not require it, using a flat mount configuration instead
Limit which guest users can invoke mount(2) and umount(2) by tightening user namespace and capability policies
Where feasible, replace virtiofs with an alternative shared filesystem transport on unpatched hosts until updates are deployed

bash

# Verify running kernel and confirm the fix is present
uname -r
# Check whether virtiofs is loaded on the guest
lsmod | grep -E 'virtiofs|fuse'
# Restrict unprivileged user namespace mounts as a hardening measure
sysctl -w kernel.unprivileged_userns_clone=0