https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 23:50:03 +0000 https://vulnerability.circl.lu/vuln/cve-2026-80858 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>fuse: publish io-uring queues with release semantics</p> <p>fuse_uring_create_queue() initializes a fuse_ring_queue and then publishes the pointer into ring-&gt;queues[qid] with WRITE_ONCE() under the fch-&gt;lock. There are several readers that may concurrently be fetching that pointer locklessly and then deferencing it.</p> <p>WRITE_ONCE() doesn&#39;t ensure ordering of the queue&#39;s field initialization before the ring-&gt;queues[qid] pointer assignment. The queue must be published with smp_store_release() so the field initialization is guaranteed to happen before.</p> <p>Readers in paths where the read may happen concurrently with the store need to use READ_ONCE() because any race involving a plain access is undefined.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>fuse: publish io-uring queues with release semantics</p> <p>fuse_uring_create_queue() initializes a fuse_ring_queue and then publishes the pointer into ring-&gt;queues[qid] with WRITE_ONCE() under the fch-&gt;lock. There are several readers that may concurrently be fetching that pointer locklessly and then deferencing it.</p> <p>WRITE_ONCE() doesn&#39;t ensure ordering of the queue&#39;s field initialization before the ring-&gt;queues[qid] pointer assignment. The queue must be published with smp_store_release() so the field initialization is guaranteed to happen before.</p> <p>Readers in paths where the read may happen concurrently with the store need to use READ_ONCE() because any race involving a plain access is undefined.</p> https://vulnerability.circl.lu/vuln/cve-2026-80858