CVE-2026-80860
Received Received - Intake

Race Condition in Linux Kernel FUSE Subsystem

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fuse: fix race between interrupt and resend After commit f8fce75fedf7 ("fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req") the WARN_ON(!list_empty(&req->intr_entry)) in fuse_request_free() still triggers due to the following race: In request_wait_answer() if (test_bit(FR_SENT, &req->flags)) -> returns true In fuse_chan_resend() clear_bit(FR_SENT, &req->flags) In request_wait_answer() queue_interrupt(req) Fix by: - move clearing FR_SENT inside fpq->lock - move setting FR_PENDING inside fiq->lock - recheck FR_SENT after acquiring fiq->lock in fuse_dev_queue_interrupt()

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80860
EUVD
EUVD-2026-71310

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition between interrupt handling and request resending in the FUSE (Filesystem in Userspace) subsystem. The issue occurs when a request is being freed while still marked as sent, leading to a warning in fuse_request_free(). The fix involves properly synchronizing access to request flags using locks to prevent the race.

Detection Guidance

This vulnerability is specific to the Linux kernel's FUSE (Filesystem in Userspace) implementation. Detection requires checking kernel logs for fuse-related warnings or errors, particularly those mentioning race conditions or interrupt handling. Monitor system logs with commands like 'dmesg | grep fuse' or 'journalctl -k | grep fuse' to identify suspicious activity.

Impact Analysis

This vulnerability could cause system instability or crashes in Linux systems using FUSE filesystems. It may lead to unexpected behavior, data corruption, or denial of service if exploited. Systems relying on FUSE for critical operations could experience disruptions.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling FUSE functionality temporarily if it is not critical to your operations. Monitor kernel security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80860. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart