Executive brief
A vulnerability was identified in the Linux kernel's FUSE (Filesystem in Userspace) subsystem when using the io-uring interface. This flaw could allow a local user to cause a system crash or instability by triggering a specific sequence of events during the shutdown of filesystem queues. The issue has been resolved in recent kernel updates.
Technical details
A use-after-free vulnerability exists in the Linux kernel's FUSE subsystem, specifically within the `fuse-uring` implementation in `fs/fuse/dev_uring.c`. The function `fuse_uring_async_stop_queues()` could execute after the final reference to `ring->queue_refs` had already been dropped, leading to premature destruction of the connection structure. An attacker with local access could potentially exploit this race condition during queue teardown to cause a kernel panic or denial of service. The fix ensures a reference to `struct fuse_conn` is held until the delayed work queue terminates. Patches have been applied to stable kernel branches including 6.18.39 and 7.1.4.
Affected products
- Linux Linux Kernel 6.14 to 6.18.39, 7.1.4, 7.2-rc1
Timeline
- 2026-06-08: other: Patch authored
- 2026-07-25: disclosed: CVE published