CVE-2026-80858fuse: publish io-uring queues with release semantics
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: fuse: publish io-uring queues with release semantics fuse_uring_create_queue() initializes a fuse_ring_queue and then publishes the pointer into ring->queues[qid] with WRITE_ONCE() under the fch->lock. There are several readers that may concurrently be fetching that pointer locklessly and then deferencing it. WRITE_ONCE() doesn't ensure ordering of the queue's field initialization before the ring->queues[qid] pointer assignment. The queue must be published with smp_store_release() so the field initialization is guaranteed to happen before. Readers in paths where the read may happen concurrently with the store need to use READ_ONCE() because any race involving a plain access is undefined.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 11, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 24fe962c86f55347385933a1b06ca71b60854690 before a5bb215dbc34b4c6a5e144ea1416bf66450d519f; from 24fe962c86f55347385933a1b06ca71b60854690 before a1bb359c443d048fe5dfd6ca9caf4e3897f3e9aa; from 24fe962c86f55347385933a1b06ca71b60854690 before 42df916e5a5f8fb4b60c8cefb54318d1ec02c580 | CNA record |
References
- https://git.kernel.org/stable/c/a5bb215dbc34b4c6a5e144ea1416bf66450d519f
- https://git.kernel.org/stable/c/a1bb359c443d048fe5dfd6ca9caf4e3897f3e9aa
- https://git.kernel.org/stable/c/42df916e5a5f8fb4b60c8cefb54318d1ec02c580
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.