CVE-2026-53272

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix use-after-free on sbi->sync_decompress

z_erofs_decompress_kickoff() can race with filesystem unmount, causing

a use-after-free on sbi->sync_decompress.

When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff()

to queue z_erofs_decompressqueue_work() asynchronously. Then, after all

folios are unlocked, unmount workflow can proceed and sbi will be freed

before accessing to sbi->sync_decompress.

Thread (unmount) I/O completion kworker

queue_work

z_erofs_decompressqueue_work

(all folios are unlocked)

cleanup_mnt

..

erofs_kill_sb

erofs_sb_free

kfree(sbi)

access sbi->sync_decompress // UAF!!