Linux FUSE: request not re-locked before page cache folio replacement, giving a use-after-free

Impact

fuse_try_move_folio() unlocks the FUSE request on entry and never re-locks it on the success path, so an abort of the FUSE channel can end the request and free the fuse_io_args while the copy logic that follows is still reading them. GPU datacenters run FUSE heavily - object-storage mounts for datasets and checkpoints, s3fs/gcsfuse sidecars next to training jobs, container image and overlay helpers - and in those deployments the userspace FUSE server is often less trusted than the kernel. Whoever controls that server, or can force a channel abort while reads are in flight, gets a use-after-free in the host kernel on a node full of other tenants' jobs. Scored 7.8 local by NVD.

Who can reach it

Local - a user or container that can mount or serve a FUSE filesystem (or abort its channel) while reads are in flight. Unprivileged FUSE mounts make this reachable to ordinary tenants; nodes that only allow root-managed FUSE mounts are correspondingly harder to reach.

What to do

Update to a stable kernel that calls lock_request() before replace_page_cache_folio(). On nodes where you cannot reboot yet, restricting unprivileged FUSE mounts narrows who can reach the path but does not fix the mounts you still need. The fix lands via the distro kernel, so each node must be drained and rebooted.

References

Related entries

• libvirt swtpm state handling: symlink following lets the swtpm user take ownership of arbitrary filesCVE-2026-63622 · libvirt (virFileChownFiles over the swtpm state directory)High
• Linux kernel (arch/x86/kvm/svm): The SEV debug-encrypt path bounds each iteration by the source page offset but not theCVE-2026-63794 · Linux kernel (arch/x86/kvm/svm)High
• Linux bpf: sysctl write buffer allocated with kvzalloc but freed with kfree, corrupting memoryCVE-2026-63809 · Linux kernel BPF cgroup sysctl hook (__cgroup_bpf_run_filter_sysctl buffer free)High
• Linux keys: unpinned request_key_auth payload lets KEYCTL_INSTANTIATE race into a use-after-freeCVE-2026-63823 · Linux kernel keyring (request_key_auth payload refcounting)High
• Linux KEYS: miscalculated output buffer length overflows on keyctl asymmetric key operationsCVE-2026-63824 · Linux kernel keyring asymmetric key ops (keyctl_pkey_params_get_2)High
• Linux arm64: stale page-table entry left in the walk cache when a hugetlb PMD table is unsharedCVE-2026-63875 · Linux kernel arm64 TLB maintenance (tlb_flush on hugetlb PMD unshare)High