Linux Kernel FUSE request_wait_answer use after free

Summaryinfo

A vulnerability marked as very critical has been reported in Linux Kernel. The impacted element is the function request_wait_answer of the component FUSE. Performing a manipulation results in use after free. This vulnerability is known as CVE-2026-80857. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Linux Kernel (the affected version is unknown). This affects the function request_wait_answer of the component FUSE. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free The abort_on_kill path in request_wait_answer() calls fuse_abort_conn() and returns without waiting for FR_FINISHED. If fuse_dev_do_write() is concurrently processing the same request (FR_LOCKED set), the caller frees req->args while it is still being accessed, causing a use-after-free. Fix this by jumping to the existing wait_event(FR_FINISHED) instead of returning early. The wait will not hang because fuse_abort_conn() ensures all requests are ended.

It is possible to read the advisory at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-80857 since 08/26/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 09/04/2026).

Applying the patch 715cb86e33cda43f5224cdc3fd5610c0b6a46f7a is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion