In the Linux kernel, the following vulnerability has been resolved:
fuse: wait for FRFINISHED on aborton_kill to prevent use-after-free
The abortonkill path in requestwaitanswer() calls fuseabortconn() and returns without waiting for FRFINISHED. If fusedevdowrite() is concurrently processing the same request (FR_LOCKED set), the caller frees req->args while it is still being accessed, causing a use-after-free.
Fix this by jumping to the existing waitevent(FRFINISHED) instead of returning early. The wait will not hang because fuseabortconn() ensures all requests are ended.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80857.json",
"cna_assigner": "Linux"
}