fuse: fix race between interrupt and resend
In the Linux kernel, the following vulnerability has been resolved: fuse: fix race between interrupt and resend After commit f8fce75fedf7 ("fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req") the WARN_ON(!list_empty(&req->intr_entry)) in fuse_request_free() still triggers due to the following race: In request_wait_answer() if (test_bit(FR_SENT, &req->flags)) -> returns true In fuse_chan_resend() clear_bit(FR_SENT, &req->flags) In request_wait_answer() queue_interrupt(req) Fix by: - move clearing FR_SENT inside fpq->lock - move setting FR_PENDING inside fiq->lock - recheck FR_SENT after acquiring fiq->lock in fuse_dev_queue_interrupt()
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 6.12.111, 6.18.51, 7.2.3
- CVEs
- CVE-2026-80860
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 15:08 UTC · Revision 1
Source evidence
fuse: fix race between interrupt and resend
core-osv · Original sourcePublished 4 Sept 2026, 15:55 UTC
In the Linux kernel, the following vulnerability has been resolved: fuse: fix race between interrupt and resend After commit f8fce75fedf7 ("fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req") the WARN_ON(!list_empty(&req->intr_entry)) in fuse_request_free() still triggers due to the following race: In request_wait_answer() if (test_bit(FR_SENT, &req->flags)) -> returns true In fuse_chan_resend() clear_bit(FR_SENT, &req->flags) In request_wait_answer() queue_interrupt(req) Fix by: - move clearing FR_SENT inside fpq->lock - move setting FR_PENDING inside fiq->lock - recheck FR_SENT after acquiring fiq->lock in fuse_dev_queue_interrupt()
osv:CVE-2026-80860
Kernel
Fixed versions: 6.12.111, 6.18.51, 7.2.3
Complete source record
{
"id": "e6009ed6c5c6cd35fa74d978becb08879407d76d0ae54073314f0dc49eadb0b7",
"url": "https://osv.dev/vulnerability/CVE-2026-80860",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "fuse: fix race between interrupt and resend",
"summary": "In the Linux kernel, the following vulnerability has been resolved: fuse: fix race between interrupt and resend After commit f8fce75fedf7 (\"fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req\") the WARN_ON(!list_empty(&req->intr_entry)) in fuse_request_free() still triggers due to the following race: In request_wait_answer() if (test_bit(FR_SENT, &req->flags)) -> returns true In fuse_chan_resend() clear_bit(FR_SENT, &req->flags) In request_wait_answer() queue_interrupt(req) Fix by: - move clearing FR_SENT inside fpq->lock - move setting FR_PENDING inside fiq->lock - recheck FR_SENT after acquiring fiq->lock in fuse_dev_queue_interrupt()",
"evidence": "osv:CVE-2026-80860",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.12.111",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.51",
"evidence": "/affected/1/ranges"
},
{
"value": "7.2.3",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-80860",
"aliases": [
"CVE-2026-80860"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "1d8ecd0cd696a5df0b2f72046a4ccee5d2a8ec2c"
},
{
"fixed": "67ddf061790e833d7e34f9dc901866c9fb25d72d"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "7366e6f4d2b4c7002b13fb01219e83679dad4127"
},
{
"fixed": "0f930904452945f409eeeb0c9afa08bf27185cb1"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "f8fce75fedf73ac72aa09163deb8f4291fdcaad2"
},
{
"fixed": "26fbe4bc3ef3ab0200407681cbef182af5d151de"
},
{
"fixed": "ed9c881f3b498383f73c42712b359419da42a7b0"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.12.96"
},
{
"fixed": "6.12.111"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.18.39"
},
{
"fixed": "6.18.51"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "7.1.4"
},
{
"fixed": "7.2"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "893479015cb6442fd389d3b553ab3036c9541715"
}
]
}
],
"versions": [
"v6.12.110",
"v6.12.109",
"v6.12.108",
"v6.12.107",
"v6.12.106",
"v6.12.105",
"v6.12.104",
"v6.12.103",
"v6.12.102",
"v6.12.101",
"v6.12.100",
"v6.12.99",
"v6.12.98",
"v6.12.97",
"v6.12.96",
"v6.18.50",
"v6.18.49",
"v6.18.48",
"v6.18.47",
"v6.18.46",
"v6.18.45",
"v6.18.44",
"v6.18.43",
"v6.18.42",
"v6.18.41",
"v6.18.40",
"v6.18.39",
"v7.1.13",
"v7.1.12",
"v7.1.11",
"v7.1.10",
"v7.1.9",
"v7.1.8",
"v7.1.7",
"v7.1.6",
"v7.1.5",
"v7.1.4"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80860.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.12.111"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.51"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.2.3"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80860.json"
}
}
],
"modified": "2026-10-28T02:30:36.781097364Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/0f930904452945f409eeeb0c9afa08bf27185cb1",
"https://git.kernel.org/stable/c/26fbe4bc3ef3ab0200407681cbef182af5d151de",
"https://git.kernel.org/stable/c/67ddf061790e833d7e34f9dc901866c9fb25d72d",
"https://git.kernel.org/stable/c/ed9c881f3b498383f73c42712b359419da42a7b0",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80860.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-80860",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80860.json"
}
},
"related_cves": [
{
"value": "CVE-2026-80860",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 504028,
"published_at": "2026-09-04T15:55:14.285+00:00"
}