Executive brief
A vulnerability in the Linux kernel's FUSE (Filesystem in Userspace) subsystem could allow a local user to cause a system crash. The issue occurs when the system incorrectly handles cancelled requests within the io_uring interface, leading to a kernel panic. This primarily impacts system availability and could be used to disrupt operations or perform a denial-of-service attack on the host.
Technical details
A vulnerability exists in the Linux kernel's FUSE io_uring implementation (fuse-uring) where fuse_uring_cancel() incorrectly moves cancelled entries to the ent_in_userspace list. When ent_list_request_expired() subsequently processes this list, it unconditionally dereferences ent->fuse_req. Because cancelled entries do not have an associated request, this results in a kernel NULL pointer dereference and system crash. The fix involves freeing the entry and properly decrementing queue references directly within the cancellation handler. This issue affects kernels using the FUSE over io_uring optimization.
Affected products
- Linux Linux Kernel 6.16 to 6.18.39, 7.1.4, 7.2-rc1
Timeline
- 2026-06-08: other: Patch authored
- 2026-07-25: disclosed: CVE published