Linux kernel FUSE: abort_on_kill returns without waiting for FR_FINISHED, freeing an in-flight request

Impact

On the abort_on_kill path, request_wait_answer() calls fuse_abort_conn() and returns without waiting for FR_FINISHED. If fuse_dev_do_write() is concurrently servicing the same request (FR_LOCKED set), the caller frees req->args while the device thread is still reading it - a kernel use-after-free. FUSE is ordinary infrastructure on GPU nodes: object-storage dataset and model mounts (s3fs, goofys, JuiceFS, gcsfuse) and virtiofs for VM and Kata sandboxes all run through it. The trigger is a task being killed at the wrong instant while a request is in flight, which a local user can attempt repeatedly. The record shows the use-after-free and the fix; it does not establish exploitability beyond that.

Who can reach it

Local user able to issue filesystem operations against a FUSE mount configured with abort_on_kill, and to have the issuing task killed. No elevated privileges needed; not reachable remotely.

What to do

Apply the stable kernel fix (linked commits, which jump to the existing wait_event(FR_FINISHED) instead of returning early) and reboot the node after draining it. No fixed release version is given in the record - only the commits.

References

Related entries

• Linux kernel FUSE: io_uring queues published without release ordering can be read half-initializedCVE-2026-80858 · Linux kernel FUSE (io_uring queue publication ordering)Unscored
• Linux kernel FUSE: missing read barrier in the io-uring readiness check can reintroduce a lock-order deadlockCVE-2026-80859 · Linux kernel FUSE (fuse-over-io-uring readiness check in fuse_block_alloc)Unscored
• Linux kernel FUSE: race between request interrupt and resend leaves a request queued on the interrupt listCVE-2026-80860 · Linux kernel FUSE (interrupt vs. resend request handling)Unscored
• Linux kernel nvme-tcp: unserialized page_frag_cache corrupts page refcounts and panics the hostCVE-2026-80862 · Linux kernel nvme-tcp (page_frag_cache used unserialized for per-request PDU preallocation)Unscored
• Linux kernel bpf: copy_user_syms calls __get_user on a userspace pointer array with no access_ok checkCVE-2026-80865 · Linux kernel BPF kprobe_multi attach (copy_user_syms)Unscored
• Linux kernel KVM/arm64 nested virt: injected SError leaves ESR_EL2 stale for the guest hypervisorCVE-2026-80873 · Linux kernel KVM/arm64 nested virtualization (ESR_EL2 on injected SError)Unscored