Executive brief
A race condition was identified in the Linux kernel's FUSE (Filesystem in Userspace) subsystem when using the io_uring interface. This flaw could allow a local attacker to cause a system crash or potentially access memory that has already been freed. The issue occurs during the teardown of background requests, where internal state was not properly synchronized between different processor cores.
Technical details
A race condition exists in fs/fuse/dev_uring.c due to improper locking when accessing the 'queue->stopped' flag. Specifically, fuse_uring_commit_fetch() read the flag without holding the queue lock, and fuse_uring_abort_end_requests() set the flag outside of the lock. This allows a 'struct fuse_req' to be freed via fuse_request_end while another thread is still performing teardown operations, potentially leading to a use-after-free or null pointer dereference. The fix ensures that the 'stopped' state is both set and validated while holding the spinlock.
Affected products
- Linux Linux 6.14 through 6.18.38, 7.1.3
Timeline
- 2026-06-08: other: Patch authored
- 2026-07-25: disclosed: CVE published