Executive brief
A vulnerability in the Linux kernel's FUSE (Filesystem in Userspace) component could allow a local user to cause a system crash or potentially access sensitive information. The issue occurs when the system fails to properly clean up internal request data after a process is interrupted. This can lead to a 'use-after-free' condition, where the system attempts to use memory that has already been released, impacting system stability and data security.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel FUSE implementation. When fuse_resend() moves a request from the processing queue back to the pending queue, it fails to remove the request's 'intr_entry' from the interrupts list. If the request was previously interrupted, this entry remains dangling. Subsequent fatal signals can cause the request to be freed while the stale 'intr_entry' is still linked. When fuse_read_interrupt() later iterates through the interrupts list, it performs a UAF write (via list_del_init) and a UAF read (leaking data to userspace). The fix involves ensuring 'intr_entry' is cleared during resend and adding validation during request destruction. Patches are available in stable kernel branches 6.12.y, 6.18.y, and 7.1.y.
Affected products
- Linux Linux Kernel 6.9 to 7.1.4
Timeline
- 2026-06-09: other: Vulnerability fixed in upstream commits
- 2026-07-25: disclosed: CVE published to NVD