Executive brief
The Linux kernel's FUSE (Filesystem in Userspace) subsystem contains a use-after-free vulnerability in request handling. When a process is killed during a filesystem operation, the kernel may free memory that is still being accessed by concurrent processing, potentially leading to kernel crashes or code execution. This affects systems using FUSE-based filesystems such as SSHFS, GlusterFS, and other userspace filesystem implementations.
Technical details
The vulnerability is a use-after-free in the FUSE device driver's request_wait_answer() function (fs/fuse/dev.c). When the abort_on_kill path is triggered (during fatal signal handling), the code calls fuse_abort_conn() and returns immediately without waiting for the FR_FINISHED flag. If fuse_dev_do_write() is concurrently processing the same request (FR_LOCKED set), the caller may free req->args while it is still being dereferenced, causing heap corruption. The fix changes the early return to a goto statement that jumps to the existing wait_event(FR_FINISHED) block, ensuring synchronization before memory is freed. The wait does not deadlock because fuse_abort_conn() guarantees all requests are terminated.
Affected products
- Linux Linux kernel versions prior to commit 64b0b5cacbd2fea88001464cb712c9dfc795b26e (approximately 5.1 and later)
Timeline
- 2026-09-04: disclosed: Published on NVD
- 2026-08-17: patched: Patch committed by Miklos Szeredi
- 2026-08-12: other: Vulnerability reported by syzbot