In the Linux kernel, the following vulnerability has been resolved:
fuse: fix race between interrupt and resend
After commit f8fce75fedf7 ("fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req") the WARN_ON(!list_empty(&req->intr_entry)) in fuse_request_free() still triggers due to the following race:
In request_wait_answer() if (test_bit(FR_SENT, &req->flags)) -> returns true
In fuse_chan_resend() clear_bit(FR_SENT, &req->flags)
In request_wait_answer() queue_interrupt(req)
Fix by:
move clearing FR_SENT inside fpq->lock
move setting FR_PENDING inside fiq->lock
recheck FR_SENT after acquiring fiq->lock in fuse_dev_queue_interrupt()
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80860.json"
}