CVE-2026-53388: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53388 Overview

CVE-2026-53388 is a use-after-free vulnerability in the Linux kernel's Filesystem in Userspace (FUSE) subsystem. The flaw resides in fuse_try_move_folio(), which unlocks the request on entry but fails to re-lock it before the success path. This allows fuse_chan_abort() to end the request and free the fuse_io_args structure while subsequent copy chain logic still references it. Local attackers with low privileges can exploit the race to trigger memory corruption in kernel space.

Critical Impact
A local, low-privileged user can trigger a use-after-free in the FUSE page cache path, potentially leading to kernel memory corruption, information disclosure, denial of service, or privilege escalation.

Affected Products

Linux kernel FUSE subsystem (multiple stable branches)
Distributions shipping vulnerable Linux kernel versions with FUSE enabled
Systems permitting unprivileged FUSE mounts

Discovery Timeline

2026-07-19 - CVE-2026-53388 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-53388

Vulnerability Analysis

The vulnerability affects the FUSE (Filesystem in Userspace) page cache handling logic in the Linux kernel. Specifically, fuse_try_move_folio() releases the request lock upon entry to perform folio replacement operations but does not reacquire that lock on the success path. This creates a window where concurrent code paths can act on the request without synchronization.

During this unlocked window, fuse_chan_abort() may terminate the outstanding request and invoke completion handlers such as fuse_readpages_end(). These handlers free the associated fuse_io_args structure. The copy chain logic that runs after fuse_try_move_folio() returns successfully then dereferences the freed fuse_io_args, resulting in a use-after-free condition [CWE-416].

A secondary consequence is that ap->folios[i]->mapping can become null in the racing path. After the fix, ap->folios[i] always points to the newfolio produced by replace_page_cache_folio(), preventing null mapping dereferences.

Root Cause

The root cause is missing lock reacquisition in fuse_try_move_folio() before calling replace_page_cache_folio(). The function's lock discipline is asymmetric: it drops the request lock at entry but does not restore it before proceeding through the success path. This violates the invariant that later copying logic assumes the request remains valid and locked.

Attack Vector

Exploitation requires local access with permissions to interact with a FUSE mount. An attacker triggers concurrent read operations against a FUSE-backed mapping while forcing channel abort conditions. Winning the race causes the completion path to free fuse_io_args while the page cache replacement path still holds a reference. The upstream fix calls lock_request() before replace_page_cache_folio() to close the race window. Patch commits are published in the mainline stable tree, including commit 030fe3e9d8ab and commit 0223f452532d.

Detection Methods for CVE-2026-53388

Indicators of Compromise

Unexpected kernel oops or panic messages referencing fuse_readpages_end, fuse_try_move_folio, or replace_page_cache_folio in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports flagging use-after-free reads in FUSE code paths
Abnormal termination of processes interacting with FUSE mounts followed by kernel warnings

Detection Strategies

Enable KASAN on test kernels to surface use-after-free conditions in the FUSE subsystem
Audit installed kernel package versions against distribution security advisories referencing CVE-2026-53388
Monitor kernel ring buffer output for stack traces containing FUSE folio replacement functions

Monitoring Recommendations

Collect and forward kernel logs to a centralized SIEM for correlation of crash signatures across hosts
Track process creation of unprivileged FUSE daemons on servers that do not require them
Alert on repeated FUSE-related kernel warnings on the same host, which may indicate exploitation attempts

How to Mitigate CVE-2026-53388

Immediate Actions Required

Apply the latest stable kernel updates from your Linux distribution that include the FUSE re-lock fix
Inventory hosts with fuse or fuse3 packages installed and prioritize patching multi-tenant systems
Restrict which users may mount FUSE filesystems using /etc/fuse.conf and mount options such as user_allow_other

Patch Information

The upstream fix reintroduces lock_request() before replace_page_cache_folio() in fuse_try_move_folio(). Backports are available across multiple stable branches. Reference commits include 46473ddccdc5, 5927b43a4f8d, 7c18691e0cfd, a078484921052, af2892249d98, and e28db6ac4792. Apply the vendor-supplied kernel package that includes these commits and reboot affected systems.

Workarounds

Disable or unload the fuse kernel module on systems that do not require userspace filesystems using modprobe -r fuse and blacklisting the module
Prevent unprivileged users from mounting FUSE filesystems by removing the setuid bit on fusermount or restricting execution via group ownership
Limit exposure of FUSE mounts on shared hosts by enforcing per-user namespaces and seccomp filters

bash

# Blacklist the FUSE module until patched kernel is deployed
echo 'blacklist fuse' | sudo tee /etc/modprobe.d/disable-fuse.conf
sudo modprobe -r fuse

# Verify installed kernel version after patching
uname -r