Executive brief
A vulnerability in the Linux kernel's FUSE (Filesystem in Userspace) component could allow a local user to cause system instability or potentially gain unauthorized access. The issue occurs when certain file system requests are cancelled, leading to memory corruption. This could result in system crashes or allow an attacker to compromise the integrity of the operating system.
Technical details
A vulnerability in the Linux kernel's FUSE implementation (specifically in fs/fuse/dev_uring.c) arises when a request is terminated before it has been committed. In this scenario, the request is not properly removed from the queue's list, resulting in a dangling list entry. This leads to list corruption and a use-after-free (UAF) condition. A local attacker with low privileges can exploit this to cause a kernel crash or potentially achieve local privilege escalation. The issue was introduced in the io-uring sqe commit support and has been resolved by ensuring requests are removed from the queue list during termination.
Affected products
- Linux Linux Kernel 6.14 to 6.18.2
Timeline
- 2025-11-25: patched: Initial fix authored by Joanne Koong
- 2026-01-13: disclosed: CVE published