The vulnerability arises because the FUSE kernel module unlocks a request in fuse_ref_folio() without re‑acquiring the lock before returning. Subsequent asynchronous operations, such as fuse_writepage_free(), may free request arguments while older code paths still attempt to access them, creating a use‑after‑free scenario. If an attacker can trigger these race conditions by interacting with a mounted FUSE filesystem, kernel memory corruption could ensue, potentially permitting local privilege escalation or denial of service. The likely attack vector is a malicious or compromised user‑space process that performs operations on a FUSE filesystem, inferred from the kernel code path.

All Linux kernel versions that contain the vulnerable FUSE code prior to the fix described in the commit references. The problem is present in the core Linux kernel and affects any deployment running a FUSE filesystem under those kernels.

The EPSS score is below 1 % and the vulnerability is not listed in CISA's KEV catalog, indicating a low probability of widespread exploitation. Nevertheless, the use‑after‑free can be triggered locally by any user that can interact with a FUSE filesystem, so systems running privileged FUSE services or exposed filesystems may be at higher risk. The CVSS score of 7.8 reflects the potential impact on kernel integrity if the flaw is successfully exploited.