Executive brief
The Linux kernel's FUSE (Filesystem in Userspace) subsystem contains a race condition in its interrupt and request resend logic. This race can cause kernel warnings and potential instability in systems using FUSE-based filesystems. While the immediate impact is a warning rather than data corruption or security breach, it indicates a synchronization bug that could be exploited or trigger crashes under specific timing conditions.
Technical details
This is a race condition in the FUSE subsystem's request handling between the interrupt path and the resend path. The vulnerability occurs when a request's FR_SENT flag is cleared in fuse_resend() without holding the required lock, while simultaneously request_wait_answer() may test this flag and attempt to queue an interrupt. The race results in a WARN_ON() assertion failing in fuse_request_free() when an intr_entry list is not properly cleared. The fix involves: (1) moving the FR_SENT bit clear operation inside the fpq->lock critical section, (2) moving FR_PENDING bit set inside fiq->lock, and (3) rechecking FR_SENT after acquiring fiq->lock in fuse_dev_queue_interrupt(). This is a synchronization/locking bug rather than a memory corruption or authentication bypass vulnerability.
Affected products
- Linux Linux kernel 6.9 and later (stable backports to earlier branches)
Timeline
- 2026-09-04: disclosed
- 2026-08-31: patched: Upstream fix authored by Miklos Szeredi