The vulnerability is a data race caused by using WRITE_ONCE instead of a proper release store (smp_store_release) when publishing a fuse_ring_queue pointer. The publication occurs while other readers may locklessly fetch and dereference the pointer before the queue’s fields are fully initialised, leading to undefined behaviour, including possible kernel memory corruption or a panic. This race can break kernel stability and potentially expose sensitive kernel data if an attacker can read or influence the incorrectly initialised structure.

The flaw resides in the Linux kernel, affecting all builds that include the FUSE io‑uring code path. The specific kernel versions impacted are not enumerated in the advisory, so any system running a kernel with this FUSE implementation is potentially vulnerable until the patch is applied.

The CVSS and EPSS metrics are not provided, and the vulnerability is not listed in CISA’s KEV catalog, indicating that it has not been confirmed as actively exploited. However, because the race occurs in kernel mode and requires concurrent access to the FUSE io‑uring queues, exploitation would generally need local privileged access to a FUSE mount. The absence of a documented exploit limits the immediate threat level, but a local attacker could induce a crash or leverage the race to gain higher privileges if coupled with additional vulnerabilities. The attack would most likely be executed by mounting a vulnerable FUSE filesystem and performing concurrent operations that trigger the unsynchronised read.