CVE-2026-68095

In the Linux kernel, the following vulnerability has been resolved:

fuse-uring: fix race between registration and connection abortion

This fixes this race:

- thread a: io_uring_enter -> register sqe ->

fuse_uring_create_ring_ent -> allocate ent but doesn't grab queue_ref

yet

- thread b: fuse_conn_destroy() -> fuse_chan_abort() ->

fuse_uring_abort() is a no-op due to queue ref being 0

- thread a: grabs the queue_ref, queue_ref is now 1, rest of

fuse_uring_do_register() logic executes

- thread b: fuse_chan_abort() returns, fuse_chan_wait_aborted() now runs

and calls

"wait_event(ring->stop_waitq, atomic_read(&ring->queue_refs) == 0);"

The abort/unmount thread will hang indefinitely in unkillable state as

nothing will decrement queue_refs or wake stop_waitq, and the ring,

queue, and ent are leaked.

Fix this by checking fch->connected under fch->lock after the created

ent has grabbed a ref count on the queue. This ensures that in the

scenario above, it is guaranteed that we either release the queue ref

and wake up stop_waitq (in case fuse_chan_wait_aborted() is already

waiting) in fuse_uring_do_register() when we detect !fch->connected, or

if the connection is aborted after the check, it is guaranteed that the

async teardown worker will be running in the background cleaning up ents

and decrementing the ent's ref on the queue, which will unblock the

eventual queue and ring teardown.