Riskcovery

CVE-2026-80857

fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free

State
Published
Severity
Not scored
Published
Sep 4, 2026
Updated
Oct 19, 2026
Reserved
Aug 26, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free

The abort_on_kill path in request_wait_answer() calls fuse_abort_conn() and returns without waiting for FR_FINISHED. If fuse_dev_do_write() is concurrently processing the same request (FR_LOCKED set), the caller frees req->args while it is still being accessed, causing a use-after-free.

Fix this by jumping to the existing wait_event(FR_FINISHED) instead of returning early. The wait will not hang because fuse_abort_conn() ensures all requests are ended.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 0c7fca880a40a209a9c92be14143996d14b93ff6 to before a8bbb2a60513bf322170903c21462f0bf4f62be2Affected
  • 204aa22a686bfee48daca7db620c1e017615f2ff to before 715cb86e33cda43f5224cdc3fd5610c0b6a46f7aAffected
  • 204aa22a686bfee48daca7db620c1e017615f2ff to before 64b0b5cacbd2fea88001464cb712c9dfc795b26eAffected
  • 300e812b882a174dca675d8028684001ad5826bcAffected
  • 6.18.25 to before 6.18.50Affected
  • 7.0.2 to before 7.1Affected
LinuxLinux
  • 7.1Affected
  • before 7.1Not affected
  • 6.18.50 through 6.18.*Not affected
  • 7.2.3 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.