In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sbi->sync_decompress z_erofs_decompress_kickoff() can race with filesystem unmount, causing a use-after-free on sbi->sync_decompress. When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff() to queue z_erofs_decompressqueue_work() asynchronously. Then, after all folios are unlocked, unmount workflow can proceed and sbi will be freed before accessing to sbi->sync_decompress. Thread (unmount) I/O completion kworker queue_work z_erofs_decompressqueue_work (all folios are unlocked) cleanup_mnt .. erofs_kill_sb erofs_sb_free kfree(sbi) access sbi->sync_decompress // UAF!!

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - erofs: fix use-after-free on sbi->sync_decompress z_erofs_decompress_kickoff() can race with filesystem     unmount, causing a use-after-free on sbi->sync_decompress. When I/O completes, z_erofs_endio() calls     z_erofs_decompress_kickoff() to queue z_erofs_decompressqueue_work() asynchronously. Then, after all     folios are unlocked, unmount workflow can proceed and sbi will be freed before accessing to     sbi->sync_decompress. Thread (unmount) I/O completion kworker queue_work z_erofs_decompressqueue_work (all     folios are unlocked) cleanup_mnt .. erofs_kill_sb erofs_sb_free kfree(sbi) access sbi->sync_decompress //     UAF!! (CVE-2026-53272)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
329305	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21388-1)	Nessus	SuSE Local Security Checks	high
329149	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3166-1)	Nessus	SuSE Local Security Checks	medium
328493	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1968)	Nessus	Amazon Linux Local Security Checks	high
327383	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1925)	Nessus	Amazon Linux Local Security Checks	high
323583	Linux Distros Unpatched Vulnerability : CVE-2026-53272	Nessus	Misc.	high

Detections

Analytics

CVE-2026-53272

high

Tenable Plugins

high

medium

high

high

high