CVE-2026-53388

In the Linux kernel, the following vulnerability has been resolved:

fuse: re-lock request before replacing page cache folio

fusetrymovefolio() unlocks the request on entry but does not re-lock it on the success path. This means fusechanabort() can end the request and free the fuseioargs (eg fusereadpagesend()) while the subsequent copy chain logic after fusetrymovefolio() accesses the fuseioargs, leading to use-after-free issues.

Fix this by calling lockrequest() before replacepagecachefolio(). This ensures the request is locked on the success path which will prevent the fuseioargs from being freed while the later copying logic runs, and also ensures that the ap->folios[i]->mapping is never null since ap->folios[i] will always point to the newfolio after replacepagecache_folio().