CVE-2026-80860

A flaw was found in the Linux kernel's FUSE (Filesystem in Userspace) component. A race condition exists between interrupt handling and request resending within the fuse_request_free() function. This race condition can lead to a kernel warning, potentially causing system instability or a denial of service (DoS) for a local attacker.

A race in FUSE request handling can occur when an interrupt is queued for a request while the same request is being resent. request_wait_answer may observe FR_SENT before fuse_chan_resend clears it and can then queue req intr_entry after the request is no longer in a valid sent state. This can leave intr_entry linked when fuse_request_free runs, triggering a WARN and creating a plausible stale list entry or UAF style lifetime problem. For the CVSS the PR:L is used because triggering requires local code execution with access to FUSE operations, not full administrative privileges. The issue is not network reachable. Impact is at least local denial of service via kernel warning or crash. In the paranoid case the stale linked request object may allow memory corruption effects and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.