CVE-2026-53129

In the Linux kernel, the following vulnerability has been resolved:

fs/mbcache: cancel shrink work before destroying the cache

mbcachedestroy() calls shrinkerfree() and then frees all cache entries and the cache itself, but it does not cancel the pending cshrink_work work item first.

If mbcacheentrycreate() schedules cshrinkwork via schedulework() and the work item is still pending or running when mbcachedestroy() runs, mbcacheshrink_worker() will access the cache after its memory has been freed, causing a use-after-free.

This is only reachable by a privileged user (root or CAPSYSADMIN) who can trigger the last put of a mounted ext2/ext4/ocfs2 filesystem.

Cancel the work item with cancelworksync() before calling shrinker_free(), ensuring the worker has finished and will not be rescheduled before the cache is torn down.