CVE-2026-80857: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80857 Overview

CVE-2026-80857 is a use-after-free vulnerability in the Linux kernel Filesystem in Userspace (FUSE) subsystem. The flaw resides in the request_wait_answer() function, where the abort_on_kill path invokes fuse_abort_conn() and returns without waiting for the FR_FINISHED state. When fuse_dev_do_write() concurrently processes the same request with FR_LOCKED set, the caller frees req->args while another kernel context still accesses it. The result is a classic race condition leading to memory corruption in kernel space.

Critical Impact
Concurrent access to freed request arguments in the FUSE subsystem can enable kernel memory corruption, potentially leading to denial of service or local privilege escalation on affected Linux systems.

Affected Products

Linux kernel (mainline) versions containing the vulnerable FUSE request_wait_answer() implementation
Linux stable kernel branches prior to the patched commits
Distributions shipping kernels that expose FUSE to unprivileged users

Discovery Timeline

2026-09-04 - CVE-2026-80857 published to the National Vulnerability Database
2026-09-07 - Last updated in NVD database

Technical Details for CVE-2026-80857

Vulnerability Analysis

The vulnerability is a Use-After-Free triggered by a race condition between request abort and request write paths in FUSE. FUSE allows userspace processes to implement filesystems, and the kernel coordinates request state through flags such as FR_LOCKED and FR_FINISHED. When a task holding a FUSE request is killed, the kernel takes the abort_on_kill branch inside request_wait_answer().

Under normal termination flow, the caller must wait for FR_FINISHED before releasing request-associated memory. The vulnerable code path invokes fuse_abort_conn() and returns immediately. If fuse_dev_do_write() is servicing that same request at the moment of return, it still holds FR_LOCKED and continues to dereference req->args. The caller proceeds to free those arguments, producing a use-after-free window in the kernel.

Root Cause

The root cause is a missing synchronization step. The abort_on_kill branch omits the wait_event(FR_FINISHED) gate that other termination paths rely on to guarantee no concurrent writer still references the request. This omission violates the invariant that request memory only becomes reclaimable after FR_FINISHED is observed.

Attack Vector

A local attacker with the ability to interact with a FUSE-backed filesystem can trigger the race by issuing requests and terminating the requesting task at a precise moment relative to fuse_dev_do_write() processing. Exploitation requires local access and the ability to influence FUSE request scheduling. Successful exploitation can corrupt kernel heap state, enabling denial of service or, with heap-shaping techniques, privilege escalation.

No public proof-of-concept exploit is currently associated with this CVE. Technical details are available in the upstream commits referenced in the Kernel Git Commit Changes, the Kernel Git Commit Update, and the Kernel Git Commit Adjustment.

Detection Methods for CVE-2026-80857

Indicators of Compromise

Kernel oops or panic messages referencing fuse_dev_do_write, request_wait_answer, or fuse_abort_conn in dmesg and system journals
KASAN reports flagging use-after-free reads or writes on FUSE request argument structures
Unexpected crashes of processes interacting with FUSE mounts under high concurrency or forced task termination

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test and staging kernels to surface the use-after-free window during fuzzing or stress testing
Monitor kernel logs for repeated slab corruption warnings or general protection faults correlated with FUSE workloads
Audit running kernel versions across the fleet and compare against the patched stable commits

Monitoring Recommendations

Ingest dmesg and /var/log/kern.log into a centralized log platform and alert on FUSE-related stack traces
Track processes that mount FUSE filesystems and correlate abnormal terminations (SIGKILL) with subsequent kernel warnings
Baseline FUSE mount activity per host and alert on unexpected use by unprivileged users

How to Mitigate CVE-2026-80857

Immediate Actions Required

Upgrade to a Linux kernel version that includes the upstream fix jumping to the existing wait_event(FR_FINISHED) in the abort_on_kill path
Apply distribution-provided kernel updates as soon as vendors publish patched builds
Inventory hosts that expose FUSE to unprivileged users and prioritize them for patching

Patch Information

The upstream fix modifies request_wait_answer() so that the abort_on_kill branch jumps to the existing wait_event(FR_FINISHED) instead of returning early. Because fuse_abort_conn() ensures all requests are ended, the wait will not hang. Patched commits are available at the Kernel Git Commit Changes, the Kernel Git Commit Update, and the Kernel Git Commit Adjustment.

Workarounds

Restrict FUSE mount capabilities to trusted users by disabling user_allow_other in /etc/fuse.conf where feasible
Remove or restrict the fuse kernel module on systems that do not require userspace filesystems
Limit unprivileged access to FUSE-backed mounts through mount namespace policies or seccomp profiles for exposed services

bash

# Verify installed kernel version and check whether the FUSE module is loaded
uname -r
lsmod | grep fuse

# Optionally blacklist the FUSE module on systems that do not require it
echo 'blacklist fuse' | sudo tee /etc/modprobe.d/blacklist-fuse.conf
sudo update-initramfs -u