---
id: CVE-2026-80859
title: 'fuse: fix missing barrier when checking io-uring readiness'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fuse: fix missing barrier when checking io-uring readiness

  fuse_block_alloc() reads fch->initialized and then fch->io_uring.
  fch->io_uring is set before fch->initializ…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3393ff964e0fa5def66570c54a4612bf9df06b76 <
    8974575898cd7a4c818088f102b2e7a0286d3302
  - >-
    Linux >= 3393ff964e0fa5def66570c54a4612bf9df06b76 <
    dd9c835709f4bb3e4256eea7573e4e6e18f956de
  - >-
    Linux >= 3393ff964e0fa5def66570c54a4612bf9df06b76 <
    edb310bc27f0ad83e7fd558a3caf1a94ca511654
  - Linux 6.14
published: '2026-09-04'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T09:57:14.427Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80859'
references:
  - url: 'https://git.kernel.org/stable/c/8974575898cd7a4c818088f102b2e7a0286d3302'
  - url: 'https://git.kernel.org/stable/c/dd9c835709f4bb3e4256eea7573e4e6e18f956de'
  - url: 'https://git.kernel.org/stable/c/edb310bc27f0ad83e7fd558a3caf1a94ca511654'
tags:
  - cve.org
epss: 0.00206
epssPercentile: 0.09481
ingestedAt: '2026-09-11T16:45:47.925Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fuse: fix missing barrier when checking io-uring readiness

fuse_block_alloc() reads fch->initialized and then fch->io_uring.
fch->io_uring is set before fch->initialized, ordered by the smp_wmb()
in fuse_chan_set_intialized(), but fuse_block_alloc() has no matching
read barrier between the two loads.

This may lead a CPU to observe fch->initialized=1 but fch->io_uring=0,
and skip the check that blocks request allocation until the io-uring
queues are ready. This can reintroduce the lock-order inversion deadlock
that commit 3393ff964e0f prevents.

Add an smp_rmb() barrier to pair with the smp_wmb() in
fuse_chan_set_initialized() to prevent this.

## Affected

- `Linux >= 3393ff964e0fa5def66570c54a4612bf9df06b76 < 8974575898cd7a4c818088f102b2e7a0286d3302`
- `Linux >= 3393ff964e0fa5def66570c54a4612bf9df06b76 < dd9c835709f4bb3e4256eea7573e4e6e18f956de`
- `Linux >= 3393ff964e0fa5def66570c54a4612bf9df06b76 < edb310bc27f0ad83e7fd558a3caf1a94ca511654`
- `Linux 6.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.