« Volver al listado

CVE-2026-80860

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

fuse: fix race between interrupt and resend

After commit f8fce75fedf7 ("fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req") the WARN_ON(!list_empty(&req->intr_entry)) in fuse_request_free() still triggers due to the following race:

Fix by:

- move clearing FR_SENT inside fpq->lock

- move setting FR_PENDING inside fiq->lock

- recheck FR_SENT after acquiring fiq->lock in fuse_dev_queue_interrupt()

Detalles técnicos trazas, registros y código del informe original
In request_wait_answer()
  if (test_bit(FR_SENT, &req->flags)) -> returns true

In fuse_chan_resend()
  clear_bit(FR_SENT, &req->flags)

In request_wait_answer()
  queue_interrupt(req)

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-80860",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "1d8ecd0cd696a5df0b2f72046a4ccee5d2a8ec2c",
              "lessThan": "67ddf061790e833d7e34f9dc901866c9fb25d72d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7366e6f4d2b4c7002b13fb01219e83679dad4127",
              "lessThan": "0f930904452945f409eeeb0c9afa08bf27185cb1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f8fce75fedf73ac72aa09163deb8f4291fdcaad2",
              "lessThan": "26fbe4bc3ef3ab0200407681cbef182af5d151de",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f8fce75fedf73ac72aa09163deb8f4291fdcaad2",
              "lessThan": "ed9c881f3b498383f73c42712b359419da42a7b0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "893479015cb6442fd389d3b553ab3036c9541715",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6.12.96",
              "lessThan": "6.12.111",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.18.39",
              "lessThan": "6.18.51",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "7.1.4",
              "lessThan": "7.2",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "fs/fuse/dev.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.2"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "7.2",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.3",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/fuse/dev.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-04T16:18:15.173",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0f930904452945f409eeeb0c9afa08bf27185cb1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/26fbe4bc3ef3ab0200407681cbef182af5d151de",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/67ddf061790e833d7e34f9dc901866c9fb25d72d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ed9c881f3b498383f73c42712b359419da42a7b0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: fix race between interrupt and resend\n\nAfter commit f8fce75fedf7 (\"fuse: clear intr_entry in fuse_resend and\nfuse_remove_pending_req\") the WARN_ON(!list_empty(&req->intr_entry)) in\nfuse_request_free() still triggers due to the following race:\n\nIn request_wait_answer()\n  if (test_bit(FR_SENT, &req->flags)) -> returns true\n\nIn fuse_chan_resend()\n  clear_bit(FR_SENT, &req->flags)\n\nIn request_wait_answer()\n  queue_interrupt(req)\n\nFix by:\n\n - move clearing FR_SENT inside fpq->lock\n\n - move setting FR_PENDING inside fiq->lock\n\n - recheck FR_SENT after acquiring fiq->lock in fuse_dev_queue_interrupt()"
    }
  ],
  "lastModified": "2026-09-21T14:17:21.050",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}