CVE-2026-80858

In the Linux kernel, the following vulnerability has been resolved:

fuse: publish io-uring queues with release semantics

fuse uring create queue() initializes a fuse ring queue and then publishes the pointer into ring->queues[qid] with WRITE ONCE() under the fch->lock. There are several readers that may concurrently be fetching that pointer locklessly and then deferencing it.

WRITE ONCE() doesn't ensure ordering of the queue's field initialization before the ring->queues[qid] pointer assignment. The queue must be published with smp store release() so the field initialization is guaranteed to happen before.

Readers in paths where the read may happen concurrently with the store need to use READ ONCE() because any race involving a plain access is undefined.