HIGH
fuse ResendInterrupt Race
CVE-2026-80860
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: fuse: fix race between interrupt and resend After commit f8fce75fedf7 ("fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req") the WARN_ON(!list_empty(&req->intr_entry)) in fuse_request_free() still triggers due to the following race: In request_wait_answer() if (test_bit(FR_SENT, &req->flags)) -> returns true In fuse_chan_resend() clear_bit(FR_SENT, &req->flags) In request_wait_answer() queue_interrupt(req) Fix by: - move clearing FR_SENT inside fpq->lock - move setting FR_PENDING inside fiq->lock - recheck FR_SENT after acquiring fiq->lock in fuse_dev_queue_interrupt()
02KernelScan AI Analysis
Risk summary
A race condition in the FUSE filesystem layer allows a local unprivileged user to trigger a use-after-free by exploiting a timing window between interrupt queuing and request resend. The corruption can leak kernel memory to userspace and enable arbitrary kernel memory writes, leading to privilege escalation or denial of service. Any system that allows unprivileged users to mount FUSE filesystems (e.g., via user namespaces) is at risk.
Vulnerability analysis
A race condition exists between the interrupt-queuing path and the request-resend path in the FUSE filesystem layer. When a FUSE request is being resent back to the pending queue, the code clears the request's sent flag without holding the appropriate lock, creating a window in which the interrupt path can observe the flag still set and queue an interrupt for a request that is no longer in the sent state. This leaves a dangling list entry on the interrupt queue; when the queue is later traversed, the kernel accesses freed memory, causing a use-after-free that can leak kernel data to userspace and corrupt heap memory. The fix moves the flag-clearing and flag-setting operations inside their respective locks and adds a recheck of the sent flag after the interrupt queue lock is acquired, closing the race window. The vulnerable path is reachable locally by any process that can interact with a FUSE filesystem mount; on systems where user namespaces are enabled, an unprivileged user can mount a FUSE filesystem and control the FUSE daemon to drive the timing needed to trigger the race.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.12.96 | 6.12.111 | 67ddf061790e |
| 6.18 | 6.18.39 | 6.18.51 | 0f9309044529 |
| 7.1 | 7.1.4 | 7.2 | 26fbe4bc3ef3 |
| mainline | — | 7.3-rc1 | — |
| 7.2 | — | 7.2.3 | ed9c881f3b49 |
| cip/6.12 | — | 6.12.111-cip32 | 67ddf061790e |