Linux Kernel up to 7.2.2 fuse fuse_block_alloc deadlock

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.2.2. It has been classified as critical. The affected element is the function fuse_block_alloc of the component fuse. The manipulation leads to deadlock. This vulnerability is documented as CVE-2026-80859. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.2 and classified as critical. This issue affects the function fuse_block_alloc of the component fuse. The manipulation with an unknown input leads to a deadlock vulnerability. Using CWE to declare the problem leads to CWE-833. The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. Impacted is availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: fuse: fix missing barrier when checking io-uring readiness fuse_block_alloc() reads fch->initialized and then fch->io_uring. fch->io_uring is set before fch->initialized, ordered by the smp_wmb() in fuse_chan_set_intialized(), but fuse_block_alloc() has no matching read barrier between the two loads. This may lead a CPU to observe fch->initialized=1 but fch->io_uring=0, and skip the check that blocks request allocation until the io-uring queues are ready. This can reintroduce the lock-order inversion deadlock that commit 3393ff964e0f prevents. Add an smp_rmb() barrier to pair with the smp_wmb() in fuse_chan_set_initialized() to prevent this.

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2026-80859 since 08/26/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/04/2026). MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 7.2.3 or 7.3-rc1 eliminates this vulnerability. Applying the patch dd9c835709f4bb3e4256eea7573e4e6e18f956de/edb310bc27f0ad83e7fd558a3caf1a94ca511654 is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion