CVE-2026-80857

What it actually does

Use-after-free in Linux kernel FUSE request_wait_answer() when abort_on_kill triggers fuse_abort_conn() and returns early without waiting for FR_FINISHED, allowing fuse_dev_do_write() to access freed req->args under FR_LOCKED.

Why it matters to the business

Kernel memory corruption on Linux systems using FUSE filesystems can cause crashes, denial of service, or potential privilege escalation, disrupting services and requiring emergency patching across fleets.

How an attack unfolds

An attacker triggers an abort condition on a FUSE request while fuse_dev_do_write() concurrently holds FR_LOCKED on the same request; the early return frees args before the writer finishes, enabling use-after-free access for memory corruption or code execution.

How to fix it

Apply the upstream kernel patch that replaces the early return with a jump to the existing wait_event(FR_FINISHED) in request_wait_answer(); rebuild and deploy the fixed kernel across affected systems.

How to confirm the fix worked

Confirm the wait_event(FR_FINISHED) change is present in the FUSE request handling code and test that abort_on_kill no longer frees args while requests remain locked and in-flight.

Typical attack path

1. Mount or interact with FUSE filesystem to create pending requests
2. Trigger abort_on_kill path in request_wait_answer()
3. Ensure concurrent fuse_dev_do_write() processing with FR_LOCKED set
4. Exploit freed req->args for memory corruption or control flow hijack

How to detect it

Review kernel logs for FUSE-related oops, use-after-free warnings, or crashes mentioning request_wait_answer and fuse_abort_conn; correlate with processes performing FUSE I/O during abort conditions.

What your security team should do

• Prioritize kernel updates containing the FUSE fix in the next maintenance window
• Audit systems for heavy FUSE usage and increase monitoring for kernel oops or memory faults
• Review custom kernels or backports for equivalent protection before deployment