CVE-2026-53272

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> erofs: fix use-after-free on sbi-&gt;sync_decompress<br /> <br /> z_erofs_decompress_kickoff() can race with filesystem unmount, causing<br /> a use-after-free on sbi-&gt;sync_decompress.<br /> <br /> When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff()<br /> to queue z_erofs_decompressqueue_work() asynchronously. Then, after all<br /> folios are unlocked, unmount workflow can proceed and sbi will be freed<br /> before accessing to sbi-&gt;sync_decompress.<br /> <br /> Thread (unmount) I/O completion kworker<br /> queue_work<br /> z_erofs_decompressqueue_work<br /> (all folios are unlocked)<br /> cleanup_mnt<br /> ..<br /> erofs_kill_sb<br /> erofs_sb_free<br /> kfree(sbi)<br /> access sbi-&gt;sync_decompress // UAF!!