Linux Kernel FUSE Subsystem Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's FUSE (Filesystem in Userspace) subsystem. The issue arises in the 'fuse_try_move_folio()' function, which improperly manages the locking of requests. Specifically, the function unlocks a request before successfully completing its operation, allowing 'fuse_chan_abort()' to terminate the request and free associated I/O arguments. This can occur while the function is still processing those arguments, leading to a use-after-free condition. The vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, which may be exploited to execute arbitrary code or cause a denial-of-service condition by crashing the system.

Reproduction

The vulnerability can be reproduced by invoking the FUSE 'splice' operation, which triggers the 'fuse_try_move_folio()' function. The function's failure to properly re-lock the request after unlocking it creates a window where the request can be aborted, and its associated I/O arguments can be freed while still being accessed, leading to a use-after-free condition.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. Instructions for upgrading the kernel can be found in the official Linux kernel documentation.