CVE-2026-80857

A flaw was found in the Linux kernel's Filesystem in Userspace (FUSE) component. This vulnerability occurs when the system attempts to free memory associated with a FUSE request while it is still being actively used. A local attacker could potentially exploit this use-after-free condition to cause a system crash (Denial of Service) or potentially execute arbitrary code with elevated privileges.

A use-after-free can occur in the FUSE request_wait_answer abort_on_kill path because the caller can abort the connection and return without waiting for FR_FINISHED while fuse_dev_do_write is concurrently processing the same request with FR_LOCKED set. The caller may then release req args while the FUSE device write path still accesses them, which can crash the kernel and may create a memory corruption primitive depending on allocator reuse and timing. For the CVSS the PR:L is used because triggering requires local code execution with access to a FUSE mount or /dev/fuse rather than a remote network packet. The issue is not network reachable in the usual deployment model. Impact is at least local denial of service via kernel crash, and the paranoid score keeps C:H/I:H/A:H because this is an explicit UAF race that should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.