CVE-2026-80858: fuse: publish io-uring queues with release semantics
In the Linux kernel, the following vulnerability has been resolved:
fuse: publish io-uring queues with release semantics
fuseuringcreatequeue() initializes a fuseringqueue and then publishes the pointer into ring->queues[qid] with WRITEONCE() under the fch->lock. There are several readers that may concurrently be fetching that pointer locklessly and then deferencing it.
WRITEONCE() doesn't ensure ordering of the queue's field initialization before the ring->queues[qid] pointer assignment. The queue must be published with smpstorerelease() so the field initialization is guaranteed to happen before.
Readers in paths where the read may happen concurrently with the store need to use READONCE() because any race involving a plain access is undefined.
Affected Software
Event History
Frequently Asked Questions
What condition is required for this issue to occur?
A FUSE io-uring queue must be created while another path concurrently reads the corresponding queue pointer without taking the lock. The reader can then dereference the pointer before the queue's field initialization is guaranteed to be visible.
Which code paths need the ordering fix?
The queue creation path must publish the queue pointer with release semantics. Reader paths that can race with publication must use READ_ONCE() when loading the pointer.
How can I determine whether the fix is present?
Check whether the kernel source includes the stable commits a1bb359c443d048fe5dfd6ca9caf4e3897f3e9aa or 42df916e5a5f8fb4b60c8cefb54318d1ec02c580. The provided data does not identify affected or fixed kernel version numbers.