https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 19:12:35 +0000 https://vulnerability.circl.lu/vuln/cve-2026-53272 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>erofs: fix use-after-free on sbi-&gt;sync_decompress</p> <p>z_erofs_decompress_kickoff() can race with filesystem unmount, causing a use-after-free on sbi-&gt;sync_decompress.</p> <p>When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff() to queue z_erofs_decompressqueue_work() asynchronously. Then, after all folios are unlocked, unmount workflow can proceed and sbi will be freed before accessing to sbi-&gt;sync_decompress.</p> <p>Thread (unmount) I/O completion kworker queue_work z_erofs_decompressqueue_work (all folios are unlocked) cleanup_mnt .. erofs_kill_sb erofs_sb_free kfree(sbi) access sbi-&gt;sync_decompress // UAF!!</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>erofs: fix use-after-free on sbi-&gt;sync_decompress</p> <p>z_erofs_decompress_kickoff() can race with filesystem unmount, causing a use-after-free on sbi-&gt;sync_decompress.</p> <p>When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff() to queue z_erofs_decompressqueue_work() asynchronously. Then, after all folios are unlocked, unmount workflow can proceed and sbi will be freed before accessing to sbi-&gt;sync_decompress.</p> <p>Thread (unmount) I/O completion kworker queue_work z_erofs_decompressqueue_work (all folios are unlocked) cleanup_mnt .. erofs_kill_sb erofs_sb_free kfree(sbi) access sbi-&gt;sync_decompress // UAF!!</p> https://vulnerability.circl.lu/vuln/cve-2026-53272