The Linux kernel vulnerability CVE-2026-53129 involves the mbcache subsystem where mb_cache_destroy() fails to cancel a pending work item (c_shrink_work) before freeing the cache memory. If mb_cache_entry_create() schedules this work and it remains pending or running during cache destruction, the worker function mb_cache_shrink_worker() may access freed memory, causing a use-after-free condition. This vulnerability is exploitable only by privileged users who can trigger the last put of a mounted ext2, ext4, or ocfs2 filesystem. The fix involves calling cancel_work_sync() to ensure the work item is fully canceled before cache teardown.

Exploitation of this vulnerability can lead to use-after-free memory access in the kernel, potentially resulting in arbitrary code execution, privilege escalation, or system instability. The impact is high as it affects confidentiality, integrity, and availability of the system. However, exploitation requires privileged access (root or CAP_SYS_ADMIN), limiting the attack surface to authorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves canceling the scheduled work item with cancel_work_sync() before freeing the cache to prevent use-after-free. Until an official patch is available, restrict privileged user access and avoid triggering the last put of affected filesystems if possible.