fuse: re-lock request before replacing page cache folio
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
AI Analysis
Technical Summary
The vulnerability in the Linux kernel's FUSE implementation occurs because fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This allows fuse_chan_abort() to end the request and free fuse_io_args while subsequent logic still accesses it, causing use-after-free conditions. The fix involves calling lock_request() before replace_page_cache_folio(), ensuring the request remains locked during the copy chain logic and preventing the use-after-free scenario.
Potential Impact
Successful exploitation could lead to use-after-free memory corruption, potentially allowing an attacker with local privileges to cause denial of service or escalate privileges by manipulating kernel memory. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available for this vulnerability. Users should update their Linux kernel to a version that includes the patch which calls lock_request() before replace_page_cache_folio() in fuse_try_move_folio(). Check the vendor or distribution advisories for the specific patched kernel versions applicable to your environment.
fuse: re-lock request before replacing page cache folio
Description
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel's FUSE implementation occurs because fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This allows fuse_chan_abort() to end the request and free fuse_io_args while subsequent logic still accesses it, causing use-after-free conditions. The fix involves calling lock_request() before replace_page_cache_folio(), ensuring the request remains locked during the copy chain logic and preventing the use-after-free scenario.
Potential Impact
Successful exploitation could lead to use-after-free memory corruption, potentially allowing an attacker with local privileges to cause denial of service or escalate privileges by manipulating kernel memory. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available for this vulnerability. Users should update their Linux kernel to a version that includes the patch which calls lock_request() before replace_page_cache_folio() in fuse_try_move_folio(). Check the vendor or distribution advisories for the specific patched kernel versions applicable to your environment.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-45w6-5frg-3vfq
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53388"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a5d27ad2a4a8d59891325b7
Added to database: 07/19/2026, 19:38:21 UTC
Last enriched: 08/15/2026, 03:42:19 UTC
Last updated: 08/30/2026, 22:52:12 UTC
Views: 89
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.