CVE-2026-80857
- Source
- https://cve.org/CVERecord?id=CVE-2026-80857
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80857.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-80857
- Downstream
- Related
- Published
- 2026-09-04T15:55:10Z
- Modified
- 2026-10-08T02:52:02Z
- Summary
- fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
The abort_on_kill path in request_wait_answer() calls fuse_abort_conn() and returns without waiting for FR_FINISHED. If fuse_dev_do_write() is concurrently processing the same request (FR_LOCKED set), the caller frees req->args while it is still being accessed, causing a use-after-free.
Fix this by jumping to the existing wait_event(FR_FINISHED) instead of returning early. The wait will not hang because fuse_abort_conn() ensures all requests are ended.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80857.json" }- References
-
- https://git.kernel.org/stable/c/64b0b5cacbd2fea88001464cb712c9dfc795b26e
- https://git.kernel.org/stable/c/715cb86e33cda43f5224cdc3fd5610c0b6a46f7a
- https://git.kernel.org/stable/c/a8bbb2a60513bf322170903c21462f0bf4f62be2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80857.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-80857
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0c7fca880a40a209a9c92be14143996d14b93ff6Fixeda8bbb2a60513bf322170903c21462f0bf4f62be2
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced204aa22a686bfee48daca7db620c1e017615f2ffFixed715cb86e33cda43f5224cdc3fd5610c0b6a46f7aFixed64b0b5cacbd2fea88001464cb712c9dfc795b26e
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.18.25Fixed6.18.50
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7.0.2Fixed7.1
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced300e812b882a174dca675d8028684001ad5826bc
Affected versions
v6.*
v6.18.25
v6.18.26
v6.18.27
v6.18.28
v6.18.29
v6.18.30
v6.18.31
v6.18.32
v6.18.33
v6.18.34
v6.18.35
v6.18.36
v6.18.37
v6.18.38
v6.18.39
v6.18.40
v6.18.41
v6.18.42
v6.18.43
v6.18.44
v6.18.45
v6.18.46
v6.18.47
v6.18.48
v6.18.49
v7.*
v7.0.10
v7.0.11
v7.0.12
v7.0.13
v7.0.14
v7.0.2
v7.0.3
v7.0.4
v7.0.5
v7.0.6
v7.0.7
v7.0.8
v7.0.9