CVE-2026-80860 Overview
CVE-2026-80860 is a race condition vulnerability in the Linux kernel's Filesystem in Userspace (FUSE) subsystem. The flaw exists in the interaction between request_wait_answer(), fuse_chan_resend(), and fuse_dev_queue_interrupt(). A concurrent resend operation can clear the FR_SENT flag while another thread queues an interrupt for the same request. This triggers a WARN_ON(!list_empty(&req->intr_entry)) inside fuse_request_free() and leaves the request in an inconsistent state. The kernel maintainers resolved the issue by tightening the locking discipline around request state transitions.
Critical Impact
The race condition can corrupt FUSE request state, produce kernel warnings, and destabilize FUSE-backed filesystems under concurrent interrupt and resend workloads.
Affected Products
- Linux kernel branches containing commit f8fce75fedf7 ("fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req")
- Systems using FUSE (Filesystem in Userspace) for user-mode filesystem drivers
- Distributions shipping affected stable kernel trees prior to the fix commits
Discovery Timeline
- 2026-09-04 - CVE-2026-80860 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-80860
Vulnerability Analysis
The vulnerability is a race condition [CWE-362] in the FUSE request lifecycle. FUSE uses per-request flags such as FR_SENT and FR_PENDING to track whether a request is in flight, and it maintains an interrupt entry list to signal userspace daemons about interrupted operations. Prior to this fix, the flag transitions and interrupt queueing were not consistently serialized under the same locks.
When a FUSE channel resends outstanding requests, fuse_chan_resend() clears FR_SENT outside of the interrupt queue lock. Concurrently, request_wait_answer() may observe FR_SENT as true and call queue_interrupt(req), which links the request onto the interrupt list. The result is that a request can end up on intr_entry after having its state reset by resend logic.
Root Cause
The root cause is inadequate locking around the FR_SENT and FR_PENDING flag transitions relative to the interrupt queue. fuse_chan_resend() cleared FR_SENT without holding fpq->lock, and queue_interrupt() did not recheck FR_SENT after acquiring fiq->lock. This time-of-check-to-time-of-use gap allowed both code paths to operate on the same request with stale flag values.
Attack Vector
Exploitation requires local execution of workloads that drive FUSE requests to interrupt and resend paths concurrently. There is no known remote or unauthenticated attack path. The most likely impact is denial of service or kernel instability on hosts running FUSE-backed filesystems, particularly under aggressive signal delivery to processes performing FUSE I/O. No public proof-of-concept or exploit code is referenced in the advisory.
The patch resolves the race by moving the clearing of FR_SENT inside fpq->lock, moving the setting of FR_PENDING inside fiq->lock, and rechecking FR_SENT after acquiring fiq->lock in fuse_dev_queue_interrupt(). Refer to the upstream commits linked below for the exact source changes.
Detection Methods for CVE-2026-80860
Indicators of Compromise
- Kernel log entries containing WARN_ON messages originating from fuse_request_free() referencing a non-empty intr_entry list.
- Repeated FUSE-related stack traces in dmesg on systems running user-mode filesystem daemons.
- Unexpected hangs or process kills involving processes performing I/O against FUSE mounts.
Detection Strategies
- Monitor dmesg and journalctl -k for FUSE warning traces on Linux hosts.
- Inventory running kernel versions against the fixed commits 0f930904, 26fbe4bc, and ed9c881f.
- Correlate FUSE daemon crashes or restarts with kernel warnings using centralized logging.
Monitoring Recommendations
- Forward kernel logs to a central SIEM and alert on WARN_ON events referencing fuse_request_free.
- Track kernel package versions across the fleet and flag hosts that lag behind vendor stable releases.
- Baseline FUSE workload behavior so that anomalous request timeouts or resend spikes are visible.
How to Mitigate CVE-2026-80860
Immediate Actions Required
- Identify hosts running FUSE-backed filesystems, including container runtimes, sshfs, and object-storage FUSE drivers.
- Update the Linux kernel to a stable release that includes the fix commits referenced in the advisory.
- Reboot affected hosts after patching to load the corrected kernel image.
Patch Information
The fix is delivered as upstream Linux kernel patches. See the following commits: Kernel commit 0f930904, Kernel commit 26fbe4bc, and Kernel commit ed9c881f. Apply the vendor kernel update from your distribution once available.
Workarounds
- Reduce reliance on FUSE mounts on affected kernels where operationally feasible.
- Avoid workloads that generate high rates of signal-driven interrupts against processes performing FUSE I/O until patches are applied.
- Restrict local user access on systems that cannot be immediately updated to limit exposure to triggering conditions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
