Executive brief
The Linux kernel's FUSE (Filesystem in Userspace) component has a logic error in handling io-uring operations that could cause system deadlocks. A missing validation check allows IO operations to proceed before proper initialization, creating a race condition between internal locks that can freeze system operations until reboot.
Technical details
The vulnerability exists in fs/fuse/dev_uring.c in the fuse_uring_cmd() function. The code was missing a condition to verify that the FUSE_OVER_IO_URING flag was set in the FUSE_INIT reply before allowing IORING_OP_URING_CMD operations. Without this check, IO operations could proceed while synchronization barriers (fuse_uring_ready()) were not properly established, causing race conditions between fch->bg_lock and queue->lock, resulting in potential deadlock states. The fix adds an explicit check for fch->io_uring and reorders the smp_load_acquire(&fch->initialized) check to execute earlier. This is a behavioral change requiring FUSE servers to explicitly set FUSE_OVER_IO_URING in FUSE_INIT replies.
Affected products
- Linux Linux kernel 5.19 and later with FUSE io-uring support enabled
Timeline
- 2026-09-17: disclosed
- 2026-08-24: patched: Mainline commit 1f59015e958174e89be58cc8db16d70a60d17255