Cloudanix VulnDB

CVE-2026-80859

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in the Linux kernel can cause file systems to freeze the whole computer under specific conditions.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing read memory barrier allows a CPU to observe fch->initialized set to 1 while fch->io_uring remains 0, bypassing the readiness check and reintroducing a lock-order inversion deadlock in FUSE request allocation.

Why it matters to the business

Systems using FUSE with io-uring may experience sudden hangs or require reboots, disrupting file system operations and any dependent applications or services.

How an attack unfolds

An attacker with local access triggers concurrent operations that expose the missing barrier, causing the kernel to allocate requests before io-uring queues are ready and deadlock the system; no named threat actors or ransomware campaigns are associated.

How to fix it

Upgrade the Linux kernel to a version containing the smp_rmb() barrier fix in fuse_block_alloc(); rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the presence of the smp_rmb() call between the loads of fch->initialized and fch->io_uring in the running kernel source or binary; test FUSE io-uring workloads for absence of deadlock.

Typical attack path

  1. Obtain local code execution on a Linux system using FUSE
  2. Trigger concurrent FUSE channel initialization and request allocation paths
  3. Exploit the reintroduced lock-order inversion to induce deadlock
  4. Cause denial of service via system hang requiring reboot

How to detect it

Review kernel logs and FUSE-related traces for unexpected deadlocks or hangs after channel initialization; no widespread exploitation indicators exist given the CVE's status.

What your security team should do

  • Prioritize kernel updates on any systems exposing FUSE with io-uring to production workloads
  • Monitor for kernel deadlocks or hangs involving fuse_block_alloc
  • Apply updates within standard patch windows given low EPSS and no KEV listing

The record

In the Linux kernel, the following vulnerability has been resolved: fuse: fix missing barrier when checking io-uring readiness fuse_block_alloc() reads fch->initialized and then fch->io_uring. fch->io_uring is set before fch->initialized, ordered by the smp_wmb() in fuse_chan_set_intialized(), but fuse_block_alloc() has no matching read barrier between the two loads. This may lead a CPU to observe fch->initialized=1 but fch->io_uring=0, and skip the check that blocks request allocation until the io-uring queues are ready. This can reintroduce the lock-order inversion deadlock that commit 3393ff964e0f prevents. Add an smp_rmb() barrier to pair with the smp_wmb() in fuse_chan_set_initialized() to prevent this.

Affected packages

Ecosystem Package Introduced Fixed