---
id: CVE-2026-80857
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free

  The abort_on_kill path in request_wait_answer() calls fuse_abort_conn()
  and returns without waiti…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free

  The abort_on_kill path in request_wait_answer() calls fuse_abort_conn()
  and returns without waiti…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0c7fca880a40a209a9c92be14143996d14b93ff6 <
    a8bbb2a60513bf322170903c21462f0bf4f62be2
  - >-
    Linux >= 204aa22a686bfee48daca7db620c1e017615f2ff <
    715cb86e33cda43f5224cdc3fd5610c0b6a46f7a
  - >-
    Linux >= 204aa22a686bfee48daca7db620c1e017615f2ff <
    64b0b5cacbd2fea88001464cb712c9dfc795b26e
  - Linux 300e812b882a174dca675d8028684001ad5826bc
  - Linux >= 6.18.25 < 6.18.50
  - Linux >= 7.0.2 < 7.1
  - Linux 7.1
published: '2026-09-04'
updated: '2026-09-07'
sourceUpdated: '2026-09-07T16:17:30.437'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80857'
references:
  - url: 'https://git.kernel.org/stable/c/64b0b5cacbd2fea88001464cb712c9dfc795b26e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/715cb86e33cda43f5224cdc3fd5610c0b6a46f7a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a8bbb2a60513bf322170903c21462f0bf4f62be2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00206
epssPercentile: 0.0948
ingestedAt: '2026-09-08T15:33:26.962Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free

The abort_on_kill path in request_wait_answer() calls fuse_abort_conn()
and returns without waiting for FR_FINISHED.  If fuse_dev_do_write() is
concurrently processing the same request (FR_LOCKED set), the caller
frees req->args while it is still being accessed, causing a
use-after-free.

Fix this by jumping to the existing wait_event(FR_FINISHED) instead of
returning early.  The wait will not hang because fuse_abort_conn()
ensures all requests are ended.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.