Executive brief
The Linux kernel's FUSE filesystem subsystem contains a race condition in its io-uring queue initialization code that could allow uninitialized data to be read or cause memory corruption. The vulnerability affects systems that use FUSE with io-uring acceleration, potentially impacting availability and data integrity of services relying on FUSE-based filesystems.
Technical details
The vulnerability is a memory ordering race condition in the fs/fuse/dev_uring.c file. The fuse_uring_create_queue() function initializes a fuse_ring_queue structure and publishes a pointer to it via ring->queues[qid] using WRITE_ONCE(), which does not provide memory ordering guarantees. Concurrent readers access ring->queues[qid] locklessly and dereference the pointer, potentially observing an incompletely initialized queue if the initialization writes are reordered after the pointer assignment. The fix replaces WRITE_ONCE() with smp_store_release() to guarantee initialization is visible before the pointer assignment, and adds READ_ONCE() to all concurrent lockless readers. This is a kernel-level synchronization fix with no user-space exploitation vector; systems are affected based on kernel version and FUSE io-uring feature enablement.
Affected products
- Linux Linux kernel 5.16 and later (FUSE io-uring feature introduced in Linux 5.16)
Timeline
- 2026-07-16: disclosed
- 2026-07-17: patched