CVE-2026-68095

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fuse-uring: fix race between registration and connection abortion

This fixes this race:

- thread a: io_uring_enter -> register sqe ->

fuse_uring_create_ring_ent -> allocate ent but doesn't grab queue_ref

yet

- thread b: fuse_conn_destroy() -> fuse_chan_abort() ->

fuse_uring_abort() is a no-op due to queue ref being 0

- thread a: grabs the queue_ref, queue_ref is now 1, rest of

fuse_uring_do_register() logic executes

- thread b: fuse_chan_abort() returns, fuse_chan_wait_aborted() now runs

and calls

"wait_event(ring->stop_waitq, atomic_read(&ring->queue_refs) == 0);"

The abort/unmount thread will hang indefinitely in unkillable state as

nothing will decrement queue_refs or wake stop_waitq, and the ring,

queue, and ent are leaked.

Fix this by checking fch->connected under fch->lock after the created

ent has grabbed a ref count on the queue. This ensures that in the

scenario above, it is guaranteed that we e

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References