CVE-2026-80859

A flaw was found in the Linux kernel's FUSE (Filesystem in Userspace) subsystem. A missing memory barrier when checking the readiness of io-uring queues could allow a CPU to observe an inconsistent state. This inconsistency can bypass a critical check, potentially reintroducing a lock-order inversion deadlock. Such a deadlock could lead to a system hang or Denial of Service.

This vulnerability is rated as Moderate impact because triggering the flaw requires local execution rights to interact with FUSE, and the resulting deadlock leads to a denial of service without exposing sensitive data or permitting privilege escalation. Exploitation depends on race conditions between thread allocations and queue setup in the io-uring interface for user-space filesystems. Supported Red Hat Enterprise Linux releases do not include the underlying FUSE io-uring functionality in their kernels and are not affected by this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.