CVE-2026-68095
kernel: fuse-uring: fix race between registration and connection abortion
Severity
UnknownRed Hat Product Security
CVSS
Review impact separately from score.
Published · August 10, 2026
Updated · October 30, 2026
Description
A flaw was found in fuse-uring in the Linux kernel. A race condition exists between the registration of an I/O operation and the abortion of a FUSE connection. This can be triggered by a local attacker or a malicious application. This flaw can cause the unmount thread to hang indefinitely, leading to a denial of service (DoS) and resource leaks.
Statement
This vulnerability does not impact Red Hat Enterprise Linux as the affected fuse-uring subsystem was introduced in upstream Linux kernel 6.14 and is not present in supported Red Hat kernels. Because the underlying code is absent, local users cannot trigger the teardown race condition or cause a denial of service through hung unmount operations.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition