Linux kernel FUSE: io_uring queues published without release ordering can be read half-initialized

Impact

fuse_uring_create_queue() initializes a fuse_ring_queue and then publishes the pointer into ring->queues[qid] with a plain WRITE_ONCE(), which orders the store but not the field initialization that precedes it. Several readers fetch that pointer locklessly and dereference it, so on a weakly ordered CPU a reader can observe the published pointer while the queue's fields are still uninitialized; the plain accesses on those read paths are undefined behaviour regardless. The practical outcome is a kernel crash or memory corruption on a node running a FUSE server that uses the io_uring transport, taking every workload on that node down with it. This is a race in the setup path rather than a directed exploit primitive, and the record describes no privilege-escalation path.

Who can reach it

Local, and only on nodes where a FUSE daemon negotiates the io_uring transport. Reaching the race requires queue creation to run concurrently with the lockless readers; the record does not describe attacker-controlled timing, and there is no remote or cross-node path.

What to do

Update to a stable kernel carrying the fix (publish with smp_store_release(), read with READ_ONCE()) and reboot the node. The exposure is confined to FUSE servers that enable io_uring, so operators who do not run one can defer to their normal kernel cadence rather than opening a window. Only the kernel commits are referenced.

References

Related entries

• Linux kernel FUSE: missing read barrier in the io-uring readiness check can reintroduce a lock-order deadlockCVE-2026-80859 · Linux kernel FUSE (fuse-over-io-uring readiness check in fuse_block_alloc)Unscored
• Linux kernel FUSE: race between request interrupt and resend leaves a request queued on the interrupt listCVE-2026-80860 · Linux kernel FUSE (interrupt vs. resend request handling)Unscored
• Linux kernel nvme-tcp: unserialized page_frag_cache corrupts page refcounts and panics the hostCVE-2026-80862 · Linux kernel nvme-tcp (page_frag_cache used unserialized for per-request PDU preallocation)Unscored
• Linux kernel bpf: copy_user_syms calls __get_user on a userspace pointer array with no access_ok checkCVE-2026-80865 · Linux kernel BPF kprobe_multi attach (copy_user_syms)Unscored
• Linux kernel KVM/arm64 nested virt: injected SError leaves ESR_EL2 stale for the guest hypervisorCVE-2026-80873 · Linux kernel KVM/arm64 nested virtualization (ESR_EL2 on injected SError)Unscored
• Linux kernel vmwgfx: integer overflow in the shader offset bound check lets an unbounded offset reach host SVGA commandsCVE-2026-80887 · Linux kernel vmwgfx (vmw_shader_define shader size+offset bound check)Unscored