Linux kernel FUSE: missing read barrier in the io-uring readiness check can reintroduce a lock-order deadlock

Impact

fuse_block_alloc() reads fch->initialized and then fch->io_uring with no read barrier between the two loads, while the writer orders them with an smp_wmb(). A CPU can therefore observe initialized=1 alongside io_uring=0, skip the check that blocks request allocation until the io-uring queues are ready, and reintroduce the lock-order inversion deadlock that commit 3393ff964e0f was written to prevent. The exposure is availability, not memory safety: the record describes no corruption and no privilege gain. On a fleet node it surfaces as hung tasks in whatever FUSE filesystem is mounted - fuse-overlayfs for rootless containers, object-store gateways, model and dataset caches - and a wedged FUSE mount generally cannot be cleared without killing the workloads sitting on it. It needs the reordering window, so weakly-ordered hosts such as arm64 GPU nodes are the realistic case.

Who can reach it

Local: any user or container able to drive a FUSE filesystem that uses fuse-over-io-uring during the window in which the connection is coming up. No authentication beyond ordinary access to the node, and no exposure at all on hosts with no fuse-over-io-uring mount.

What to do

Update to a stable kernel containing commit dd9c8357 or edb310bc and reboot each node; the fix is a one-line smp_rmb() in FUSE core and ships as a kernel update, not a daemon restart. No fixed release number is given in the record. FUSE mounts that do not use the io-uring path are unaffected in the meantime.

References

Related entries

• Linux kernel FUSE: race between request interrupt and resend leaves a request queued on the interrupt listCVE-2026-80860 · Linux kernel FUSE (interrupt vs. resend request handling)Unscored
• Linux kernel nvme-tcp: unserialized page_frag_cache corrupts page refcounts and panics the hostCVE-2026-80862 · Linux kernel nvme-tcp (page_frag_cache used unserialized for per-request PDU preallocation)Unscored
• Linux kernel bpf: copy_user_syms calls __get_user on a userspace pointer array with no access_ok checkCVE-2026-80865 · Linux kernel BPF kprobe_multi attach (copy_user_syms)Unscored
• Linux kernel KVM/arm64 nested virt: injected SError leaves ESR_EL2 stale for the guest hypervisorCVE-2026-80873 · Linux kernel KVM/arm64 nested virtualization (ESR_EL2 on injected SError)Unscored
• Linux kernel vmwgfx: integer overflow in the shader offset bound check lets an unbounded offset reach host SVGA commandsCVE-2026-80887 · Linux kernel vmwgfx (vmw_shader_define shader size+offset bound check)Unscored
• Linux kernel vmwgfx: dma_buf reference leaked on foreign prime import pins the exporter's memory indefinitelyCVE-2026-80888 · Linux kernel vmwgfx (ttm_prime_fd_to_handle foreign-fd prime import)Unscored