CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's FUSE (Filesystem in Userspace) implementation, specifically in the handling of concurrent requests during the abort_on_kill process. This flaw can lead to a use-after-free condition, potentially allowing an attacker to exploit memory access violations, which may result in system crashes or arbitrary code execution. Linux system administrators and developers utilizing FUSE should prioritize applying the patch to mitigate this risk.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free The abort_on_kill path in request_wait_answer() calls fuse_abort_conn() and returns without waiting for FR_FINISHED. If fuse_dev_do_write() is concurrently processing the same request (FR_LOCKED set), the caller frees req->args while it is still being accessed, causing a use-after-free. Fix this by jumping to the existing wait_event(FR_FINISHED) instead of returning early. The wait will not hang because fuse_abort_conn() ensures all requests are ended.