In the Linux kernel, the following vulnerability has been resolved:
fuse: fix race between interrupt and resend
After commit f8fce75fedf7 ("fuse: clear intrentry in fuseresend and fuseremovependingreq") the WARNON(!listempty(&req->intrentry)) in fuserequestfree() still triggers due to the following race:
In requestwaitanswer() if (testbit(FRSENT, &req->flags)) -> returns true
In fusechanresend() clearbit(FRSENT, &req->flags)
In requestwaitanswer() queue_interrupt(req)
Fix by:
move clearing FR_SENT inside fpq->lock
move setting FR_PENDING inside fiq->lock
recheck FRSENT after acquiring fiq->lock in fusedevqueueinterrupt()
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80860.json",
"cna_assigner": "Linux"
}