{"api_version":"1","generated_at":"2026-08-22T14:50:30+00:00","cve":"CVE-2026-68095","urls":{"html":"https://cve.report/CVE-2026-68095","api":"https://cve.report/api/cve/CVE-2026-68095.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68095","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68095"},"summary":{"title":"fuse-uring: fix race between registration and connection abortion","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfuse-uring: fix race between registration and connection abortion\n\nThis fixes this race:\n- thread a: io_uring_enter -> register sqe ->\n  fuse_uring_create_ring_ent -> allocate ent but doesn't grab queue_ref\n  yet\n- thread b: fuse_conn_destroy() -> fuse_chan_abort() ->\n  fuse_uring_abort() is a no-op due to queue ref being 0\n- thread a: grabs the queue_ref, queue_ref is now 1, rest of\n  fuse_uring_do_register() logic executes\n- thread b: fuse_chan_abort() returns, fuse_chan_wait_aborted() now runs\n  and calls\n  \"wait_event(ring->stop_waitq, atomic_read(&ring->queue_refs) == 0);\"\nThe abort/unmount thread will hang indefinitely in unkillable state as\nnothing will decrement queue_refs or wake stop_waitq, and the ring,\nqueue, and ent are leaked.\n\nFix this by checking fch->connected under fch->lock after the created\nent has grabbed a ref count on the queue. This ensures that in the\nscenario above, it is guaranteed that we either release the queue ref\nand wake up stop_waitq (in case fuse_chan_wait_aborted() is already\nwaiting) in fuse_uring_do_register() when we detect !fch->connected, or\nif the connection is aborted after the check, it is guaranteed that the\nasync teardown worker will be running in the background cleaning up ents\nand decrementing the ent's ref on the queue, which will unblock the\neventual queue and ring teardown.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-10 13:19:53","updated_at":"2026-08-17 05:18:08"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/2cd945492bc5b472e814272e88b731bb9bb17629","name":"https://git.kernel.org/stable/c/2cd945492bc5b472e814272e88b731bb9bb17629","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3bca70235a706de76fe9a81defd37d987062c686","name":"https://git.kernel.org/stable/c/3bca70235a706de76fe9a81defd37d987062c686","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/952b5d36f6a298f57c52a59e72076c69386a8aaf","name":"https://git.kernel.org/stable/c/952b5d36f6a298f57c52a59e72076c69386a8aaf","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68095","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68095","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 24fe962c86f55347385933a1b06ca71b60854690 3bca70235a706de76fe9a81defd37d987062c686 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 24fe962c86f55347385933a1b06ca71b60854690 2cd945492bc5b472e814272e88b731bb9bb17629 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 24fe962c86f55347385933a1b06ca71b60854690 952b5d36f6a298f57c52a59e72076c69386a8aaf git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.14","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.14 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"68095","cve":"CVE-2026-68095","epss":"0.001660000","percentile":"0.062940000","score_date":"2026-08-17","updated_at":"2026-08-18 00:11:47"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/fuse/dev_uring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3bca70235a706de76fe9a81defd37d987062c686","status":"affected","version":"24fe962c86f55347385933a1b06ca71b60854690","versionType":"git"},{"lessThan":"2cd945492bc5b472e814272e88b731bb9bb17629","status":"affected","version":"24fe962c86f55347385933a1b06ca71b60854690","versionType":"git"},{"lessThan":"952b5d36f6a298f57c52a59e72076c69386a8aaf","status":"affected","version":"24fe962c86f55347385933a1b06ca71b60854690","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/fuse/dev_uring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"6.14","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfuse-uring: fix race between registration and connection abortion\n\nThis fixes this race:\n- thread a: io_uring_enter -> register sqe ->\n  fuse_uring_create_ring_ent -> allocate ent but doesn't grab queue_ref\n  yet\n- thread b: fuse_conn_destroy() -> fuse_chan_abort() ->\n  fuse_uring_abort() is a no-op due to queue ref being 0\n- thread a: grabs the queue_ref, queue_ref is now 1, rest of\n  fuse_uring_do_register() logic executes\n- thread b: fuse_chan_abort() returns, fuse_chan_wait_aborted() now runs\n  and calls\n  \"wait_event(ring->stop_waitq, atomic_read(&ring->queue_refs) == 0);\"\nThe abort/unmount thread will hang indefinitely in unkillable state as\nnothing will decrement queue_refs or wake stop_waitq, and the ring,\nqueue, and ent are leaked.\n\nFix this by checking fch->connected under fch->lock after the created\nent has grabbed a ref count on the queue. This ensures that in the\nscenario above, it is guaranteed that we either release the queue ref\nand wake up stop_waitq (in case fuse_chan_wait_aborted() is already\nwaiting) in fuse_uring_do_register() when we detect !fch->connected, or\nif the connection is aborted after the check, it is guaranteed that the\nasync teardown worker will be running in the background cleaning up ents\nand decrementing the ent's ref on the queue, which will unblock the\neventual queue and ring teardown."}],"providerMetadata":{"dateUpdated":"2026-08-17T04:58:43.670Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/3bca70235a706de76fe9a81defd37d987062c686"},{"url":"https://git.kernel.org/stable/c/2cd945492bc5b472e814272e88b731bb9bb17629"},{"url":"https://git.kernel.org/stable/c/952b5d36f6a298f57c52a59e72076c69386a8aaf"}],"title":"fuse-uring: fix race between registration and connection abortion","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68095","datePublished":"2026-08-10T11:58:08.590Z","dateReserved":"2026-07-30T09:28:09.367Z","dateUpdated":"2026-08-17T04:58:43.670Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-10 13:19:53","lastModifiedDate":"2026-08-17 05:18:08","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68095","Ordinal":"1","Title":"fuse-uring: fix race between registration and connection abortio","CVE":"CVE-2026-68095","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68095","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nfuse-uring: fix race between registration and connection abortion\n\nThis fixes this race:\n- thread a: io_uring_enter -> register sqe ->\n  fuse_uring_create_ring_ent -> allocate ent but doesn't grab queue_ref\n  yet\n- thread b: fuse_conn_destroy() -> fuse_chan_abort() ->\n  fuse_uring_abort() is a no-op due to queue ref being 0\n- thread a: grabs the queue_ref, queue_ref is now 1, rest of\n  fuse_uring_do_register() logic executes\n- thread b: fuse_chan_abort() returns, fuse_chan_wait_aborted() now runs\n  and calls\n  \"wait_event(ring->stop_waitq, atomic_read(&ring->queue_refs) == 0);\"\nThe abort/unmount thread will hang indefinitely in unkillable state as\nnothing will decrement queue_refs or wake stop_waitq, and the ring,\nqueue, and ent are leaked.\n\nFix this by checking fch->connected under fch->lock after the created\nent has grabbed a ref count on the queue. This ensures that in the\nscenario above, it is guaranteed that we either release the queue ref\nand wake up stop_waitq (in case fuse_chan_wait_aborted() is already\nwaiting) in fuse_uring_do_register() when we detect !fch->connected, or\nif the connection is aborted after the check, it is guaranteed that the\nasync teardown worker will be running in the background cleaning up ents\nand decrementing the ent's ref on the queue, which will unblock the\neventual queue and ring teardown.","Type":"Description","Title":"fuse-uring: fix race between registration and connection abortio"}]}}}