High · published July 25, 2026
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: Avoid queue->stopped races and set/read that value under lock
There are several readers of queue->stopped that check the value
under lock, but fuse_uring_commit_fetch() did not and actually
the value was not set under the lock in fuse_uring_abort_end_requests()
either. Especially in fuse_uring_commit_fetch it is important
to check under a lock, because due to races 'struct fuse_req'
might be freed with fuse_request_end, but another thread/cpu
might already do teardown work.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 6.14, < 6.18.39 | 6.18.39 |
| linux/linux_kernel | ≥ 6.19, < 7.1.4 | 7.1.4 |