CVE-2026-80858: In the Linux kernel, the following vulnerability has been resolved: fuse: publish io-uring queues with release semantic
Summary
A vulnerability in the Linux kernel's fuse (filesystem in userspace) module occurs when a queue pointer is published without proper memory ordering guarantees, potentially allowing other threads to read partially initialized data. The fix requires using smp_store_release() (a memory synchronization operation that ensures all previous writes complete before the pointer assignment) instead of WRITE_ONCE() when publishing the queue, and READ_ONCE() (a volatile read that prevents compiler optimizations from causing race conditions) when reading it.
Solution / Mitigation
The source text indicates the vulnerability is resolved by replacing WRITE_ONCE() with smp_store_release() when publishing the queue pointer in fuse_uring_create_queue(), and using READ_ONCE() in reader code paths that may access the pointer concurrently. However, no specific patch version, CVE status update, or kernel version number where this fix appears is mentioned in the provided content.
Vulnerability Details
EPSS: 0.0%
September 4, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-80858
First tracked: September 4, 2026 at 02:08 PM
Classified by LLM (prompt v3) · confidence: 95%