CVE-2026-80860: fuse: fix race between interrupt and resend
In the Linux kernel, the following vulnerability has been resolved:
fuse: fix race between interrupt and resend
After commit f8fce75fedf7 ("fuse: clear intrentry in fuseresend and fuseremovependingreq") the WARNON(!listempty(&req->intrentry)) in fuserequestfree() still triggers due to the following race:
In requestwaitanswer() if (testbit(FRSENT, &req->flags)) -> returns true
In fusechanresend() clearbit(FRSENT, &req->flags)
In requestwaitanswer() queueinterrupt(req)
Fix by:
- move clearing FRSENT inside fpq->lock
- move setting FRPENDING inside fiq->lock
- recheck FRSENT after acquiring fiq->lock in fusedevqueueinterrupt()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel systems that use FUSE may be affected when a FUSE request can be interrupted while it is being resent. The provided information does not identify specific kernel versions or configurations.
How can administrators identify that the race has occurred?
The race can cause the WARN_ON(!list_empty(&req->intr_entry)) check in fuse_request_free() to trigger. Kernel warning logs containing that condition are an indicator of the affected request-state race.
What condition triggers the problem?
It requires a race in which request_wait_answer() observes FR_SENT, fuse_chan_resend() clears FR_SENT, and request_wait_answer() then queues an interrupt. The fix synchronizes the relevant flag updates and rechecks FR_SENT while holding the interrupt-queue lock.