CVE-2026-80858: Linux Kernel Race Condition Vulnerability

CVE-2026-80858 Overview

CVE-2026-80858 is a race condition in the Linux kernel's Filesystem in Userspace (FUSE) io-uring implementation. The flaw exists in fuse_uring_create_queue(), which publishes a newly initialized fuse_ring_queue pointer into ring->queues[qid] using WRITE_ONCE() under fch->lock. Concurrent readers dereference that pointer locklessly without acquiring the same lock. Because WRITE_ONCE() does not provide release semantics, initialization of the queue's fields can be reordered after the pointer publication. Readers may then observe a non-NULL pointer while the queue's internal state is still uninitialized, leading to undefined behavior in kernel context.

Critical Impact
Concurrent lockless readers may dereference a partially initialized fuse_ring_queue structure, producing undefined kernel behavior including potential memory corruption or crashes.

Affected Products

Linux kernel FUSE subsystem with io-uring support enabled
Stable kernel branches receiving the fixing commits 42df916e5a5f, a1bb359c443d, and a5bb215dbc34
Distributions shipping vulnerable FUSE io-uring code paths

Discovery Timeline

2026-09-04 - CVE-2026-80858 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-80858

Vulnerability Analysis

The FUSE io-uring subsystem maintains an array of per-queue structures indexed by queue ID. When a new queue is created, fuse_uring_create_queue() allocates and initializes a fuse_ring_queue object, then publishes the pointer into ring->queues[qid]. The writer holds fch->lock, but multiple readers on other CPUs access ring->queues[qid] without acquiring that lock.

The writer uses WRITE_ONCE() for the pointer store. WRITE_ONCE() only prevents compiler tearing and reordering; it does not emit the memory barrier required to order prior stores against the pointer publication on weakly ordered architectures such as ARM64. As a result, a reader on another CPU may observe the published pointer before the queue's field initialization becomes visible.

When a lockless reader dereferences a partially initialized queue, kernel behavior becomes undefined. Consequences range from reading garbage field values to following invalid pointers, potentially producing kernel panics or memory corruption. The Linux Kernel Memory Model classifies any data race involving a plain access as undefined behavior.

Root Cause

The root cause is missing release-acquire ordering between queue initialization and pointer publication. The fix replaces WRITE_ONCE() with smp_store_release() on the writer side and requires readers on concurrent paths to use READ_ONCE() (paired with the release) to observe a fully initialized queue. This is a classic publication race in a lockless-read, locked-write pattern.

Attack Vector

Triggering the race requires local access to a system with FUSE io-uring in use. An unprivileged process that can create and interact with FUSE mounts using io-uring may concurrently drive queue creation and lookup paths across multiple CPUs. Successful races produce undefined behavior in kernel context. This is a local reliability and memory-safety issue rather than a remote code execution primitive; no public exploit is available.

Refer to the upstream fixing commits for the specific code changes: Kernel Git Commit 42df916, Kernel Git Commit a1bb359, and Kernel Git Commit a5bb215.

Detection Methods for CVE-2026-80858

Indicators of Compromise

Unexplained kernel oops or panics referencing fuse_uring_create_queue, fuse_ring_queue, or FUSE io-uring call paths
KASAN or UBSAN reports flagging use of uninitialized memory inside FUSE io-uring code
Sporadic crashes on multi-core systems running FUSE filesystems with io-uring enabled

Detection Strategies

Inventory running kernel versions and identify hosts that have not received the fixing commits
Enable KASAN, KCSAN, and UBSAN in test kernels to surface the race during pre-production validation
Correlate kernel crash telemetry with FUSE and io-uring workload activity to identify regression patterns

Monitoring Recommendations

Forward kernel.log, dmesg, and kdump output to a centralized log platform for review of FUSE-related faults
Track loaded kernel modules and FUSE mount activity from untrusted or containerized workloads
Alert on process crashes and abnormal syscall patterns from processes issuing io-uring operations against FUSE mounts

How to Mitigate CVE-2026-80858

Immediate Actions Required

Apply the upstream stable kernel updates containing commits 42df916e5a5f, a1bb359c443d, and a5bb215dbc34
Prioritize patching multi-tenant hosts and container platforms where untrusted local code may drive FUSE io-uring workloads
Reboot patched systems to activate the fixed kernel image

Patch Information

The fix converts the pointer publication in fuse_uring_create_queue() from WRITE_ONCE() to smp_store_release(), and updates concurrent readers to use READ_ONCE() so that queue field initialization is guaranteed to be visible before the pointer is observed. Apply the vendor kernel package that incorporates the referenced stable commits. Distribution-specific advisories should be consulted for exact package versions.

Workarounds

Disable FUSE io-uring code paths where the workload does not require them, falling back to the traditional FUSE transport
Restrict unprivileged user namespace and FUSE mount creation on shared hosts using sysctl controls such as kernel.unprivileged_userns_clone=0 where policy permits
Limit exposure of FUSE mounts to trusted workloads until patched kernels are deployed

bash

# Verify running kernel and check for FUSE io-uring usage
uname -r
lsmod | grep -E 'fuse|io_uring'

# Restrict unprivileged FUSE mount creation (policy dependent)
sysctl -w kernel.unprivileged_userns_clone=0

# After applying vendor kernel update, reboot and confirm version
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-generic
sudo reboot