CVE-2026-53272: Linux Kernel EROFS Use-After-Free Race Condition

Technical summary

The vulnerability exists in the z_erofs compression handling code within the EROFS filesystem driver. When I/O completion triggers z_erofs_endio(), it calls z_erofs_decompress_kickoff() to asynchronously queue decompression work via z_erofs_decompressqueue_work(). The race condition occurs because the filesystem unlock process—which occurs after decompression—does not synchronize with the unmount cleanup path. An unmount operation can proceed to erofs_kill_sb() and subsequently free the superblock structure (sbi) via kfree() before the queued decompression worker accesses sbi->sync_decompress. This leaves a dangling pointer dereference (use-after-free) that executes in kernel context with elevated privileges. The vulnerability is classified as CWE-416 (use-after-free).

Business impact

Organizations running services on systems with EROFS-based storage are at risk of availability disruption. A local attacker or unprivileged user who can trigger concurrent I/O operations and filesystem unmounts may crash the kernel or, in certain configurations, escalate privileges. For embedded systems, IoT devices, or containerized environments using EROFS for read-only root filesystems, this creates a denial-of-service vector. Cloud providers and data center operators should assess whether EROFS is in use in their kernel configurations and guest operating systems.

Affected systems

The vulnerability affects the Linux kernel. Exploitation requires local access to a system running a kernel with EROFS support compiled in. Systems using EROFS for storage—common in embedded Linux, container images, and some enterprise storage appliances—are at risk. The vulnerability does not affect systems that do not have EROFS support enabled or that do not mount EROFS filesystems. Verify your kernel configuration and mounted filesystems to determine exposure.

Exploitability

This is a local vulnerability with low attack complexity. The attacker must have user-level access to the system and must be able to trigger the specific race condition between I/O completion and filesystem unmount. While the vulnerability is not trivial to exploit reliably (as it requires precise timing), it does not require elevated privileges to initiate. The CVSS score of 7.8 reflects high impact (confidentiality, integrity, and availability) combined with local access requirements. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Apply kernel patches that synchronize the decompression work queue with filesystem unmount operations. The fix involves ensuring that pending decompression work is properly cancelled or completed before the superblock structure is freed. Affected Linux distributions will release kernel security updates; verify patch availability from your distribution vendor. For systems that do not require EROFS functionality, disabling EROFS in the kernel configuration at compile time eliminates the vulnerability.

Patch guidance

Consult your Linux distribution's security advisory for kernel update availability. Mainstream distributions (Red Hat Enterprise Linux, Ubuntu, Debian, SUSE, etc.) will issue CVE patches in their respective kernel maintenance branches. Apply updates following your organization's change management procedures. For systems with EROFS compiled as a module, a kernel rebuild or module replacement may be sufficient. For embedded or custom kernel builds, apply upstream kernel patches from the Linux kernel mailing list or your distribution's patch repository. After patching, verify the fix by examining kernel version or patch level, and consider a system reboot to ensure the patched code is active.

Detection guidance

Monitor system logs for kernel oops, panic messages, or warnings originating from the EROFS or z_erofs subsystems. Kernel crash dumps should be analyzed for stack traces containing z_erofs_decompressqueue_work() or z_erofs_endio(). On systems with SELinux or AppArmor enabled, monitor audit logs for denial events related to EROFS operations. Endpoint Detection and Response (EDR) tools should flag unexpected kernel crashes correlated with filesystem unmount operations. Network-level detection is not applicable since this is a local kernel race condition. Actively scan system configurations to identify which systems have EROFS enabled.

Why prioritize this

A CVSS score of 7.8 (HIGH) combined with the kernel-context execution context and privilege implications warrants prompt attention. Although exploitation requires local access and is not currently being weaponized, the availability and integrity impact makes this a significant risk in multi-user or container environments. Systems supporting untrusted users or running containers should be prioritized. Patching should occur within your standard critical/high-severity kernel update window, typically 30 days or sooner depending on your risk tolerance.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects: Attack Vector (Local) and Attack Complexity (Low), indicating an unprivileged local user can trigger the condition relatively easily; Privileges Required (Low), meaning the attacker does not need administrative access; User Interaction (None); and Scope (Unchanged). The score is driven by High impact across Confidentiality, Integrity, and Availability due to the kernel-context execution and potential for privilege escalation or data corruption. The score does not reach Critical (9.0+) because the vulnerability requires local access and specific race condition timing.

Frequently asked questions