Executive brief
The Linux kernel's FUSE filesystem implementation contains a synchronization bug in how it checks whether io-uring queues are ready for request handling. Without a proper memory barrier, the kernel may incorrectly believe that queues are ready when they are not, allowing requests to proceed prematurely. This can trigger a deadlock condition that corrupts the lock ordering within the filesystem, potentially causing system hangs or data corruption.
Technical details
The vulnerability is a missing memory barrier (smp_rmb) in the fuse_block_alloc() function. The function reads two related flags—fch->initialized and fch->io_uring—but lacks a read barrier between these loads. On the write side, fuse_chan_set_initialized() orders these writes with smp_wmb(), but the corresponding read-side barrier was absent. This race allows a CPU to observe initialized=1 but io_uring=0, causing the function to skip checks that block allocation until io-uring is ready. The consequence is reintroduction of a lock-order inversion deadlock prevented by an earlier commit. The fix adds smp_rmb() in fuse_block_alloc() to pair with the write barrier, ensuring memory ordering constraints are respected. The patch was backported across Linux stable branches and requires no userspace interaction to exploit.
Affected products
- Linux Linux kernel multiple versions (see kernel stable releases)
Timeline
- 2026-09-04: disclosed: CVE-2026-80859 published
- 2026-07-16: patched: Fix authored by Joanne Koong