Linux kernel FUSE: abort_on_kill returns without waiting for FR_FINISHED, freeing an in-flight request

Impact

On the abort_on_kill path, request_wait_answer() calls fuse_abort_conn() and returns without waiting for FR_FINISHED. If fuse_dev_do_write() is concurrently servicing the same request (FR_LOCKED set), the caller frees req->args while the device thread is still reading it - a kernel use-after-free. FUSE is ordinary infrastructure on GPU nodes: object-storage dataset and model mounts (s3fs, goofys, JuiceFS, gcsfuse) and virtiofs for VM and Kata sandboxes all run through it. The trigger is a task being killed at the wrong instant while a request is in flight, which a local user can attempt repeatedly. The record shows the use-after-free and the fix; it does not establish exploitability beyond that.

Who can reach it

Local user able to issue filesystem operations against a FUSE mount configured with abort_on_kill, and to have the issuing task killed. No elevated privileges needed; not reachable remotely.

What to do

Apply the stable kernel fix (linked commits, which jump to the existing wait_event(FR_FINISHED) instead of returning early) and reboot the node after draining it. No fixed release version is given in the record - only the commits.

References

Related entries

• Linux kernel nvme-tcp: unserialized page_frag_cache corrupts page refcounts and panics the hostCVE-2026-80862 · Linux kernel nvme-tcp (page_frag_cache used unserialized for per-request PDU preallocation)Unscored
• Linux kernel bpf: copy_user_syms calls __get_user on a userspace pointer array with no access_ok checkCVE-2026-80865 · Linux kernel BPF kprobe_multi attach (copy_user_syms)Unscored
• Linux kernel vmwgfx: integer overflow in the shader offset bound check lets an unbounded offset reach host SVGA commandsCVE-2026-80887 · Linux kernel vmwgfx (vmw_shader_define shader size+offset bound check)Unscored
• Linux kernel vmwgfx: dma_buf reference leaked on foreign prime import pins the exporter's memory indefinitelyCVE-2026-80888 · Linux kernel vmwgfx (ttm_prime_fd_to_handle foreign-fd prime import)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical