A use-after-free vulnerability in the Linux kernel fuse-uring subsystem allows local authenticated attackers to achieve high confidentiality, integrity, and availability impact.

This is a use-after-free flaw caused by fuse_uring_async_stop_queues executing after the final reference on ring queue references has been dropped, requiring low privileges and local access.

A successful exploit of this vulnerability can lead to complete system compromise, including unauthorized data access, modification, or total denial of service. The CVSS score of 7.8 reflects the high severity of potential impacts, although the requirement for local execution reduces the immediate external exposure.

Immediate Action: Update the Linux kernel to version 6.18.39, 7.1.4, or later versions containing the official fix commits.

Proactive Monitoring: Monitor local system logs for kernel panics, segmentation faults, or unusual process behavior associated with the fuse subsystem.

Compensating Controls: Restrict local shell access and auditing user privileges to minimize the risk of untrusted users executing malicious code on the host.

Public Exploit Available: false

Security teams must prioritize applying the latest kernel patches to all vulnerable Linux systems. Prompt remediation is critical to prevent potential local privilege escalation and system instability stemming from the use-after-free condition.