CVE-2026-80857 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
The abort_on_kill path in request_wait_answer() calls fuse_abort_conn() and returns without waiting for FR_FINISHED. If fuse_dev_do_write() is concurrently processing the same request (FR_LOCKED set), the caller frees req->args while it is still being accessed, causing a use-after-free.
Fix this by jumping to the existing wait_event(FR_FINISHED) instead of returning early. The wait will not hang because fuse_abort_conn() ensures all requests are ended.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel's FUSE (Filesystem in Userspace) subsystem facilitates communication between user-space file systems and the kernel by managing request queues and connection states. A critical concurrency flaw was identified within the abort_on_kill path of the fuse_dev_do_write function, specifically during the execution of request_wait_answer. This vulnerability arises from a race condition where the kernel fails to properly synchronize state transitions when terminating requests associated with killed processes or connections. The core issue lies in the premature return behavior that bypasses necessary synchronization primitives, leading to memory safety violations and potential system instability.
The technical root cause involves an improper handling of request lifecycle states within fuse_dev_do_write. When a connection is aborted due to kill signals, the abort_on_kill path invokes fuse_abort_conn() but returns immediately without ensuring that all associated requests have reached their final state. Specifically, if another thread or context is concurrently processing the same FUSE request and holds the FR_LOCKED flag, it may proceed to free the req->args structure while the aborted connection handler still references these arguments. This lack of synchronization results in a use-after-free condition, where memory allocated for request arguments is accessed after being deallocated by another execution path.
This vulnerability poses significant operational risks including kernel panics, data corruption, and potential privilege escalation vectors if an attacker can trigger concurrent access patterns under specific timing conditions. The absence of proper waiting mechanisms allows the system to operate on freed memory regions, which may contain stale pointers or corrupted data structures. Such scenarios compromise both confidentiality and integrity guarantees within the operating environment, particularly in multi-tenant systems where FUSE is commonly deployed for containerized storage solutions or cloud-native file services.
To mitigate this vulnerability, the fix implements a synchronization mechanism that ensures all requests reach their FR_FINISHED state before proceeding with cleanup operations. By jumping to an existing wait_event loop rather than returning early, the kernel guarantees that fuse_abort_conn() has completed its work and terminated all active requests safely. This approach maintains system stability by preventing premature memory reclamation while preserving performance characteristics through efficient event-driven waiting mechanisms.
From a standards perspective, this vulnerability aligns with CWE-416: Use After Free, which describes situations where pointers are used after they have been freed leading to undefined behavior and potential exploitation. Additionally, the attack vector relates to ATT&CK technique T1059: Command and Scripting Interpreter through indirect means via kernel module interactions or FUSE-based service manipulation. Organizations should ensure their Linux kernels are updated with patches addressing this specific race condition in fuse_dev_do_write functionality.
Security practitioners monitoring for exploitation indicators should look for unusual kernel oops messages related to memory access violations within FUSE subsystems, particularly those occurring during process termination scenarios involving file system operations. Regular vulnerability scanning and patch management procedures remain essential defenses against such low-level concurrency flaws that could otherwise be leveraged in sophisticated attack chains targeting enterprise infrastructure relying on Linux-based storage solutions.