CVE-2026-80857

In the Linux kernel, the following vulnerability has been resolved:

fuse: wait for FR FINISHED on abort on kill to prevent use-after-free

The abort on kill path in request wait answer() calls fuse abort conn() and returns without waiting for FR FINISHED. If fuse dev do write() is concurrently processing the same request (FR LOCKED set), the caller frees req->args while it is still being accessed, causing a use-after-free.

Fix this by jumping to the existing wait event(FR FINISHED) instead of returning early. The wait will not hang because fuse abort conn() ensures all requests are ended.