Executive brief
The Linux kernel's fuse-uring subsystem contains a race condition that can occur when a connection is being registered while another thread is simultaneously aborting the connection. This race can cause the abort/unmount operation to hang indefinitely in an unkillable state, preventing proper system shutdown or filesystem unmounting and leaving kernel resources leaked.
Technical details
This is a race condition in the fuse-uring io_uring integration within the Linux kernel filesystem code. The vulnerability occurs when thread A is registering an io_uring submission queue entry while thread B is simultaneously aborting the fuse connection. Thread A allocates a ring entry but fails to grab a queue reference before thread B's abort path checks and finds the queue reference count at 0 (making the abort a no-op). When thread A then increments the queue reference and thread B's wait for queue_refs==0 is triggered, the system deadlocks because nothing can decrement the queue reference. The fix adds a connected-state check under the fuse connection lock after acquiring the queue reference, ensuring proper synchronization between registration and teardown paths. Attack vector is local/adjacent, requiring concurrent operations on an active fuse connection. Patches are available in Linux kernel stable branches.
Affected products
- Linux Linux kernel versions with fuse-uring support (6.0+)
Timeline
- 2026-08-10: disclosed
- 2026-08-03: patched: patch merged to stable kernel trees