CVE-2026-80857: fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-04 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free The abort_on_kill path in request_wait_answer() calls fuse_abort_conn() and returns without waiting for FR_FINISHED. If fuse_dev_do_write() is concurrently processing the same request (FR_LOCKED set), the caller frees req->args while it is still being accessed, causing a use-after-free. Fix this by jumping to the existing wait_event(FR_FINISHED) instead of returning early. The wait will not hang because fuse_abort_conn() ensures all requests are ended.

Affected products

Linux kernel: from 6.18.25 before 6.18.50; from 7.0.2 before 7.1; 7.1 — fixed in 6.18.50, 7.1, 7.3

How to fix

Upgrade to a fixed version: Linux kernel 6.18.50, 7.1, 7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-80857 or the next vulnerability affects your stack