Executive brief
The Linux kernel's CUSE (Character Device in UserSpace) module has a race condition where it can attempt to execute freed module code during shutdown. When the cuse module is unloaded, pending memory cleanup operations may still reference functions in the module after they have been removed from memory, causing a system crash or potentially allowing malicious code execution.
Technical details
This is a use-after-free vulnerability in the CUSE subsystem triggered by a race condition between module unload and RCU callback execution. The root cause is that fuse_conn_put() performs asynchronous deallocation via call_rcu() (introduced in commit 053fc4f755ad to fix an earlier UAF), but the cuse_fc_release() callback resides in the dynamically-unloadable cuse module. If the module is unloaded before the RCU grace period completes, the callback attempts to jump into freed kernel memory. The vulnerable component is cuse_exit(), which does not synchronize with pending RCU callbacks. The attack vector is local (module unload) with no authentication required. An attacker with module unload privileges can trigger a kernel panic (denial of service) or potentially execute arbitrary code if the freed virtual address is reused. The fix is to call rcu_barrier() in cuse_exit() to ensure all pending callbacks complete before module removal.
Affected products
- Linux Linux kernel post-commit 053fc4f755ad
Timeline
- 2026-09-17: disclosed