The issue described is a race condition in the Linux kernel’s FUSE subsystem. A race exists between a request’s interrupt handling and a resend operation, causing an inconsistent state that triggers a WARN_ON() when the request’s interrupt entry list is not empty. This inconsistency can lead to kernel warnings or even a crash if the fault propagates, effectively denying service to user‑space processes that rely on FUSE volumes.

All Linux kernel implementations that contain the unpatched FUSE driver are affected. The vulnerability exists in versions prior to the commit f8fce75fedf7, which was merged into mainline kernel releases. Linux distributions that have not applied this commit, or that run kernels built from older source trees, remain vulnerable.

The CVSS and EPSS scores are not publicly available, and the vulnerability is not listed in CISA’s KEV catalog, so official risk ratings are unknown. The likely attack vector is local or through an application that can trigger repeated FUSE requests; an attacker who can induce the race condition may force the kernel to emit WARN_ON messages or potentially crash, disrupting service availability. Because the exploit relies on race timing and specific FUSE traffic, the practical likelihood of exploitation is uncertain but it remains a high‑priority issue for environments that rely heavily on FUSE.