CVE-2026-53388: fuse: re-lock request before replacing page cache folio

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• linux linux kernel2.6.35 and later · before 5.15.211
• linux linux kernel5.16 and later · before 6.1.177
• linux linux kernel6.2 and later · before 6.6.144
• linux linux kernel6.7 and later · before 6.12.95
• linux linux kernel6.13 and later · before 6.18.37
• linux linux kernel6.19 and later · before 7.0.14
• linux linux kernel7.1 and later · before 7.1.2

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 2.6.35affected
  • ce534fb052928ce556639d7ecf01cbf4e01321e1 and later · before 7c18691e0cfda29672f79bafde8abdb7710674f6affected · git
  • ce534fb052928ce556639d7ecf01cbf4e01321e1 and later · before 5927b43a4f8d89e86930f524bf63e9c7e66f61b4affected · git
  • ce534fb052928ce556639d7ecf01cbf4e01321e1 and later · before 030fe3e9d8abdee303dd7e9e42f45082d382a407affected · git
  • ce534fb052928ce556639d7ecf01cbf4e01321e1 and later · before 46473ddccdc5065033e397d6e62c280dbcd3d9c2affected · git
  • ce534fb052928ce556639d7ecf01cbf4e01321e1 and later · before af2892249d982a1c036ca456cc135374e68b6677affected · git
  • ce534fb052928ce556639d7ecf01cbf4e01321e1 and later · before 0223f452532d9cd8a5e87c45de828fd93c99bd25affected · git
  • ce534fb052928ce556639d7ecf01cbf4e01321e1 and later · before e28db6ac4792d065ab32565fd9f0a2361c3d4666affected · git
  • ce534fb052928ce556639d7ecf01cbf4e01321e1 and later · before a078484921052d0badd827fcc2770b5cfc1d4120affected · git
  • before 2.6.35not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2026-53384Jul 19, 2026 · serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
  39Monitor
• ← EarlierCVE-2026-53385Jul 19, 2026 · vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
  22Monitor
• Later →CVE-2026-53391Jul 19, 2026 · NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
  30Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.