CVE-2026-80859
Received Received - Intake

Race Condition in Linux Kernel FUSE Subsystem

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fuse: fix missing barrier when checking io-uring readiness fuse_block_alloc() reads fch->initialized and then fch->io_uring. fch->io_uring is set before fch->initialized, ordered by the smp_wmb() in fuse_chan_set_intialized(), but fuse_block_alloc() has no matching read barrier between the two loads. This may lead a CPU to observe fch->initialized=1 but fch->io_uring=0, and skip the check that blocks request allocation until the io-uring queues are ready. This can reintroduce the lock-order inversion deadlock that commit 3393ff964e0f prevents. Add an smp_rmb() barrier to pair with the smp_wmb() in fuse_chan_set_initialized() to prevent this.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80859
EUVD
EUVD-2026-71309

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition in the Linux kernel's FUSE (Filesystem in Userspace) subsystem. It involves a missing memory barrier when checking if io-uring queues are ready. The issue occurs because one CPU core might see the initialization flag set before the io-uring queues are actually ready, potentially causing a deadlock that was previously fixed.

Detection Guidance

This vulnerability is specific to the Linux kernel's FUSE (Filesystem in Userspace) implementation and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying the presence of the fix in your kernel version. Commands like 'dmesg | grep fuse' or 'uname -a' may help identify affected systems.

Impact Analysis

This could lead to system hangs or crashes under specific conditions involving FUSE filesystems and io-uring operations. Users might experience unresponsive systems or applications when accessing certain filesystems.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this issue. If no update is available, consider disabling FUSE or io-uring features temporarily until a patch is applied. Monitor kernel security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80859. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart