01 Record

CVE-2026-53381

virtiofs: fix UAF on submount umount

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

virtiofs: fix UAF on submount umount

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.13% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 3.2% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-19.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-07-19 11:59Z3 MO AGO

Last updated

2026-10-19 20:07Z9 DAYS AGO

Reserved

2026-06-09

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-416Use After FreeVariant

Data version

5.2

Document digest

745d03fc51651826c3964026f8d8008379e937d0ab28b07442f301453912c635

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux548e1f2bac1d4df91a6138f26bb4ab00323fd948 to < 607a1d4c42f649e6197567c0448fd9ebb316cd42, cfd1aa3e2b71f3327cb373c45a897c9028c62b35 to < 1cc0e3a0c6499aaaa2f21a4fcbba388486afb25e, 83b375c6efef69b1066ad2d79601221e7892745a to < 0b809199ff87c44487e516a725dd4be2185712ce, bfd17b6138df0122a95989457d8e18ce0b86165e to < 2181a09ba980f142650fb053666350ead4471cfe, b26923512dbe57ae4917bafd31396d22a9d1691a to < 97c4691653d145dcc699eca5d3aba3219a520f1f, 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 to < 2abfd3ffbd9452f72535d96ff3982b3ab1f8f2f9, 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 to < 39a2b95e008665c14f84e50ed411d898df7cd11b, 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 to < e09412a714bcd49375198427bb4aa005037a9d6f, 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 to < 06b41351779e9289e8785694ade9042ae85e41ea, f19a1390af448d9e193c08e28ea5f727bf3c3049, 5.10.246 to < 5.10.260, 5.15.196 to < 5.15.211, 6.1.158 to < 6.1.177, 6.6.115 to < 6.6.144, 6.12.54 to < 6.12.95, 6.17.4 to < 6.18, 6.18—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/607a1d4c42f649e6197567c0448fd9ebb316cd42
git.kernel.orghttps://git.kernel.org/stable/c/1cc0e3a0c6499aaaa2f21a4fcbba388486afb25e
git.kernel.orghttps://git.kernel.org/stable/c/0b809199ff87c44487e516a725dd4be2185712ce
git.kernel.orghttps://git.kernel.org/stable/c/2181a09ba980f142650fb053666350ead4471cfe
git.kernel.orghttps://git.kernel.org/stable/c/97c4691653d145dcc699eca5d3aba3219a520f1f
git.kernel.orghttps://git.kernel.org/stable/c/2abfd3ffbd9452f72535d96ff3982b3ab1f8f2f9
git.kernel.orghttps://git.kernel.org/stable/c/39a2b95e008665c14f84e50ed411d898df7cd11b
git.kernel.orghttps://git.kernel.org/stable/c/e09412a714bcd49375198427bb4aa005037a9d6f
git.kernel.orghttps://git.kernel.org/stable/c/06b41351779e9289e8785694ade9042ae85e41ea

07 Fixed in

Debian 12

linux
Fixed in 6.1.177-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.95-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.0.14-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.