CVE-2026-80858
Received Received - Intake

Use-After-Free in Linux Kernel fuse_uring

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fuse: publish io-uring queues with release semantics fuse_uring_create_queue() initializes a fuse_ring_queue and then publishes the pointer into ring->queues[qid] with WRITE_ONCE() under the fch->lock. There are several readers that may concurrently be fetching that pointer locklessly and then deferencing it. WRITE_ONCE() doesn't ensure ordering of the queue's field initialization before the ring->queues[qid] pointer assignment. The queue must be published with smp_store_release() so the field initialization is guaranteed to happen before. Readers in paths where the read may happen concurrently with the store need to use READ_ONCE() because any race involving a plain access is undefined.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80858
EUVD
EUVD-2026-71308

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper synchronization when publishing io-uring queues in the FUSE subsystem. The issue occurs in fuse_uring_create_queue() where a queue pointer is published with WRITE_ONCE() without ensuring prior initialization of the queue's fields. This can lead to race conditions where concurrent readers may access uninitialized or partially initialized data.

Detection Guidance

This vulnerability is specific to the Linux kernel's FUSE (Filesystem in Userspace) implementation and requires kernel-level inspection. Detection involves checking kernel versions and FUSE module behavior. Use commands like 'uname -a' to check kernel version and 'lsmod | grep fuse' to verify FUSE module status. Monitor kernel logs for FUSE-related errors or warnings.

Impact Analysis

This vulnerability could cause system instability, crashes, or data corruption if exploited. It may allow attackers to trigger undefined behavior or memory corruption by exploiting race conditions during queue initialization and access.

Mitigation Strategies

Apply the latest kernel patches from your distribution to ensure the fix for CVE-2026-80858 is included. If patches are unavailable, consider disabling FUSE if not required, or restrict access to FUSE-based filesystems. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80858. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart