The flaw lies in the fuse driver when a request that had previously been interrupted is resent. The driver removes the request from the processing queue and marks it pending, but fails to detach its interrupt list entry if the request had the FR_INTERRUPTED flag. When the task later receives a fatal signal, fuse_remove_pending_req removes the request from the pending list and frees it without cleaning the stale interrupt entry. A subsequent fuse_read_interrupt operation walks the interrupt list and encounters this dangling entry, performing a list delete on freed memory and then reading data that has already been released to userspace. This Use‑After‑Free allows a memory corruption that can manifest as a denial‑of‑service or as an execution of arbitrary code with kernel privileges, potentially enabling local privilege escalation.

Affected systems: The vulnerability resides in the Linux kernel’s fuse subsystem. All kernel configurations that build or load the fuse module remain vulnerable until the patch that clears the intr_entry during resend is applied. No specific kernel version range is listed; therefore, the entire set of Linux distributions that include the unfixed fuse driver is impacted.

Risk and exploitability: The EPSS score of less than 1% indicates a low probability of exploitation at the current time. The vulnerability is not listed in the CISA KEV catalog, but the lack of a public exploit does not mitigate the inherent severity—an attacker with local access to a process that interacts with fuse can trigger the UAF. The absence of a high exploit probability does not change the requirement for a prompt patch, given the potential for kernel compromise and data leakage.