A use-after-free vulnerability in the Linux kernel FUSE subsystem may allow a local attacker to achieve elevated privileges or cause system instability.

The vulnerability occurs because the fuse_ref_folio function unlocks a request without re-locking it before returning. This race condition allows fuse_chan_abort to end the request and free associated arguments while the kernel is still accessing them, resulting in a use-after-free condition exploitable by a local user with low privileges.

Successful exploitation of this vulnerability permits a local, low-privileged user to execute arbitrary code or cause a kernel panic, leading to full system compromise or denial of service. While the attack vector requires local access, the CVSS score of 7.8 (High) reflects the severity of the impact, as it provides a direct path for privilege escalation within the operating system.

Immediate Action: Update the Linux kernel to the corrected versions: 5.10.261, 5.15.212, 6.1.178, or 6.6.145, depending on your distribution branch.

Proactive Monitoring: Review system logs for kernel oops or segmentation faults that may indicate a crash triggered by a use-after-free event, particularly when interacting with FUSE-based filesystems.

Compensating Controls: Restrict access to mounting FUSE filesystems to only trusted users or disable the FUSE module entirely if it is not required for system operations.

Public Exploit Available: Unknown

Given that this vulnerability resides within the core Linux kernel, it poses a substantial risk to system integrity. Administrators should prioritize patching their kernel builds as soon as official updates are released by their respective Linux distributions. Organizations running environments where untrusted users can execute code locally should treat this as a high-priority remediation task to prevent potential privilege escalation.