fuse: publish io-uring queues with release semantics (CVE-2026-80858) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-80858

fuse: publish io-uring queues with release semantics

Answer in brief

CVE-2026-80858 records a Unknown severity vulnerability in fuse: publish io-uring queues with release semantics. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 4, 2026Updated Sep 4, 2026Source checked Sep 4, 2026First seen by HOL Sep 4, 2026Material review Sep 4, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=24fe962c86f55347385933a1b06ca71b60854690 <a1bb359c443d048fe5dfd6ca9caf4e3897f3e9aa \|\| >=24fe962c86f55347385933a1b06ca71b60854690 <42df916e5a5f8fb4b60c8cefb54318d1ec02c580	a1bb359c443d048fe5dfd6ca9caf4e3897f3e9aa, 42df916e5a5f8fb4b60c8cefb54318d1ec02c580
Linux/Linuxgeneric	6.14	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to a1bb359c443d048fe5dfd6ca9caf4e3897f3e9aa if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 4, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: fuse: publish io-uring queues with release semantics fuse_uring_create_queue() initializes a fuse_ring_queue and then publishes the pointer into ring->queues[qid] with WRITE_ONCE() under the fch->lock. There are several readers that may concurrently be fetching that pointer locklessly and then deferencing it. WRITE_ONCE() doesn't ensure ordering of the queue's field initialization before the ring->queues[qid] pointer assignment. The queue must be published with smp_store_release() so the field initialization is guaranteed to happen before. Readers in paths where the read may happen concurrently with the store need to use READ_ONCE() because any race involving a plain access is undefined.

Quoted source text, attributed separately from HOL analysis.