Use-After-Free Vulnerability in Linux Kernel's EROFS Filesystem

CVE-2026-53272

What is CVE-2026-53272?

A use-after-free vulnerability exists in the Linux kernel's EROFS (Enhanced Read-Only File System) implementation, specifically in the handling of synchronization decompression methods. The vulnerability arises during the unmounting of the filesystem when I/O operations are still being processed. As z_erofs_decompress_kickoff triggers the asynchronous queuing of decompression work, there is a risk that the system will free the filesystem state before the queued work completes. This can lead to dereferencing a pointer to freed memory, potentially allowing an attacker to execute arbitrary code or cause a denial of service.

References