Linux kernel FUSE: race between request interrupt and resend leaves a request queued on the interrupt list

Impact

request_wait_answer() can test FR_SENT and see it set at the moment fuse_chan_resend() clears it, then queue an interrupt for a request that is being resent. The request ends up freed with a non-empty intr_entry, which is what the WARN_ON in fuse_request_free() catches - so the observable symptom in the record is a kernel warning, but the underlying state is the interrupt list being manipulated by two paths at once. The fix moves the FR_SENT clear under fpq->lock, the FR_PENDING set under fiq->lock, and rechecks FR_SENT after taking fiq->lock. It matters on nodes whose FUSE daemon resends requests - server restart or failover of a fuse-backed container image, dataset or object-store mount. Note this is a follow-up to an earlier incomplete fix (commit f8fce75fedf7), so a kernel carrying only that commit is still affected.

Who can reach it

Local: requires a FUSE server that resends in-flight requests plus interrupt delivery on the same request, so it is driven by the filesystem daemon and its clients rather than by an arbitrary remote party. No authentication beyond normal node access.

What to do

Update to a stable kernel containing commit 26fbe4bc or ed9c881f and reboot each node. The record names no fixed release number, and there is no configuration-level mitigation other than not exercising FUSE request resend.

References

Related entries

• Linux kernel nvme-tcp: unserialized page_frag_cache corrupts page refcounts and panics the hostCVE-2026-80862 · Linux kernel nvme-tcp (page_frag_cache used unserialized for per-request PDU preallocation)Unscored
• Linux kernel bpf: copy_user_syms calls __get_user on a userspace pointer array with no access_ok checkCVE-2026-80865 · Linux kernel BPF kprobe_multi attach (copy_user_syms)Unscored
• Linux kernel KVM/arm64 nested virt: injected SError leaves ESR_EL2 stale for the guest hypervisorCVE-2026-80873 · Linux kernel KVM/arm64 nested virtualization (ESR_EL2 on injected SError)Unscored
• Linux kernel vmwgfx: integer overflow in the shader offset bound check lets an unbounded offset reach host SVGA commandsCVE-2026-80887 · Linux kernel vmwgfx (vmw_shader_define shader size+offset bound check)Unscored
• Linux kernel vmwgfx: dma_buf reference leaked on foreign prime import pins the exporter's memory indefinitelyCVE-2026-80888 · Linux kernel vmwgfx (ttm_prime_fd_to_handle foreign-fd prime import)Unscored
• Linux kernel hugetlb: fork() corrupts migration and hwpoison swap entries by clearing uffd-wp at the wrong bitCVE-2026-80893 · Linux kernel mm/hugetlb (uffd-wp clearing in copy_hugetlb_page_range)Unscored