This vulnerability is a use-After-Free condition in the Linux kernel fuse-uring subsystem. When the function fuse_uring_async_stop_queues can run after the last reference to ring->queue_refs has been released, it may operate on freed memory, resulting in kernel memory corruption. The weakness is identified as CWE-416 and CWE-825. Corruption of kernel memory can cause system crashes or allow an attacker to execute arbitrary code in kernel mode if the flaw is successfully triggered.

All installations of the Linux kernel that do not include the protective reference added in the recent commit are potentially affected. The patch that resolves the issue adds a reference on struct fuse_conn before starting fuse_uring_async_stop_queues; any kernel version prior to that commit could still contain the flaw.

The CVSS score of 7.8 indicates high severity. The EPSS score is less than 1 %, implying a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is not explicitly documented; the likely vector involves a local or privileged process that can invoke fuse_uring_async_stop_queues, but this is inferred from the description.