CVE-2026-53129: Linux Kernel mbcache Use-After-Free in Filesystem Unmount

Technical summary

CVE-2026-53129 is a use-after-free vulnerability (CWE-416) in fs/mbcache.c. The mb_cache_destroy() function calls shrinker_free() followed by cache entry deallocation without first canceling the c_shrink_work work item. If mb_cache_shrink_worker() is pending or executing when destruction occurs, it will dereference freed cache metadata. The vulnerability is triggered when a privileged user unmounts an ext2, ext4, or ocfs2 filesystem that has pending shrink operations. The fix involves calling cancel_work_sync() on the work item before calling shrinker_free(), ensuring the worker completes and cannot be rescheduled during cache teardown.

Business impact

This vulnerability primarily impacts systems running ext2, ext4, or ocfs2 filesystems where a privileged user (root or CAP_SYS_ADMIN capability holder) can trigger unmount operations. A crash (denial of service) is the most likely outcome; kernel code execution depends on heap layout and exploitation sophistication. Organizations managing shared systems, containers, or multi-tenant environments where unprivileged users have sudo access to mount operations face elevated risk. Single-user or air-gapped systems have lower practical exposure.

Affected systems

The Linux kernel is affected across all versions until patched. Specific impact is limited to systems using ext2, ext4, or ocfs2 filesystems with the ability for privileged users or CAP_SYS_ADMIN-capable processes to unmount filesystems. This includes: production Linux servers running these filesystems, container hosts, virtual machines, and systems with overly permissive sudoers configurations that grant mount/umount privileges.

Exploitability

Exploitation requires local access and elevated privileges (root or CAP_SYS_ADMIN). The attack requires explicit action to unmount a filesystem while a shrink worker is pending or in flight—a race condition that is difficult to trigger reliably but possible through repeated mount/unmount cycles or crafted workloads. CVSS 3.1 score of 7.8 (HIGH) reflects high impact (crash/code execution) and low attack complexity, but privileges required are elevated. This is not remotely exploitable and does not appear on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Apply a kernel update that includes the fix: cancel_work_sync() call on c_shrink_work before shrinker_free() in mb_cache_destroy(). Verify the patch version against your Linux distribution's advisory. Until patched, mitigate by restricting mount/umount privileges via sudoers or AppArmor/SELinux policies to only trusted administrators. Monitor for unexpected kernel crashes or log messages related to mbcache or filesystem unmount operations.

Patch guidance

Obtain and test the latest kernel security update from your Linux distribution (Red Hat, Ubuntu, Debian, SUSE, etc.). Verify the fix is present by checking the mb_cache_destroy() function in fs/mbcache.c for the cancel_work_sync() call. Kernel rebuild may be necessary if your distribution has not yet released a patched version. Schedule deployment during a maintenance window due to required reboot. Prioritize systems where unprivileged users have mount/umount capabilities or where ext4/ocfs2 filesystems are frequently mounted/unmounted.

Detection guidance

Monitor kernel logs for use-after-free warnings or NULL pointer dereference messages related to mbcache or shrinker operations during filesystem unmount. Watch for repeated kernel crashes following unmount operations, particularly on systems with dynamic storage provisioning or container orchestration. Deploy KASAN (Kernel Address Sanitizer) or similar runtime checks on test systems to catch memory corruption events. Correlate unmount events with system instability using auditd rules on mount/umount syscalls and monitor exit codes.

Why prioritize this

Although privileged-user-only and not actively exploited (KEV=false), the HIGH CVSS score and potential for denial of service or privilege escalation warrant prompt patching on systems with exposed mount/umount privileges. Container and multi-tenant environments should prioritize this, as should systems where developers or operators have sudo access to filesystem management. Organizations with strict privilege separation can defer slightly, but no system should remain unpatched indefinitely.

Risk score, explained

CVSS 3.1 of 7.8 (HIGH) is driven by: Attack Vector: Local (AV:L), Attack Complexity: Low (AC:L), Privileges Required: Low (PR:L), User Interaction: None (UI:N), Scope: Unchanged (S:U), and Confidentiality/Integrity/Availability all set to High (C:H/I:H/A:H). The score reflects potential for crash and possible code execution, but is tempered by the requirement for local privileged access. Risk is contextualized by your environment's privilege model and filesystem usage patterns.

Frequently asked questions