Executive brief
A vulnerability was identified in the Linux kernel's FUSE (Filesystem in Userspace) subsystem when using the io_uring interface. A technical error during data transfers can cause the system to crash (NULL pointer dereference), potentially leading to a denial of service. This affects systems relying on FUSE for specialized filesystem operations.
Technical details
A NULL pointer dereference exists in fs/fuse/dev_uring.c within the Linux kernel. When a copy into the userspace ring buffer fails, fuse_uring_req_end() sets ent->fuse_req to NULL but fails to remove the entry from ent_w_req_queue or update its state from FRRS_FUSE_REQ. If the request expiration logic scans the queue before the entry is properly moved, it attempts to dereference the NULL pointer. This is a local attack vector requiring the ability to interact with FUSE-uring. Patches have been released for various stable branches including 6.18.x and 7.1.x.
Affected products
- Linux Linux Kernel 6.16 to 6.18.39, 7.1.4
Timeline
- 2026-06-09: other: Patch authored
- 2026-07-25: disclosed: CVE published